Independent password security
Weak passwords are still the cheapest way into your accounts
Check how strong a password really is, generate one you can trust, and follow plain-English guides for locking down email, banking and work accounts. Every tool runs in your browser — nothing you type is sent, logged or stored.
Free tools, no strings
Client-side only. No accounts, no tracking pixels, no "sign up to see your result".
Latest guides
Explained from first principles, with sources you can check.
What to Do After a Data Breach: A Timed Response Checklist
Know what to do after a data breach with this timed response guide — first 15 minutes, first day, and first week actions to stop the damage spreading.
Passkeys vs Passwords: What Actually Changes for You
A plain-English guide to passkeys vs passwords: how the key pair works, why phishing fails, what to do if you lose your device, and how to start migra
Password Manager Buying Guide: What Actually Matters
Our password manager buying guide covers zero-knowledge encryption, passkey support, breach monitoring, and what to verify before trusting your vault.
From the blog
Twice a week: what has changed, and what to do about it.
Credential Stuffing: Why Password Reuse Is the Whole Attack
Credential stuffing uses breached passwords from one site to silently break into others. Learn exactly how the attack works and the concrete steps to
12 Character Password: The Rule, Its Origins, and Its Limits
The 12 character password rule isn't in any official standard. Learn where it came from, when it fails, and what length actually protects you.
Why this site exists
Most password advice is either vague ("use a strong password") or trying to sell you something. This site does the opposite: it shows you the maths behind a password's strength, tells you which habits actually matter, and keeps the tools free and private. We earn from affiliate links when we recommend something we would buy anyway, and every one of those links is labelled.
Common questions
Is it safe to type my password into this site?
Yes — and you can verify it yourself. Every tool on this site is JavaScript that runs inside your browser; the password you type is never sent to our server, logged, or stored. Open your browser's developer tools and watch the network panel: no request carries your input. If you would rather not type a real password at all, test a variant with the same length and character mix.
How long should a password be in 2026?
Use at least 12 characters, and 16 or more for anything that protects money, email or identity. Length beats complexity: a 16-character passphrase of ordinary words is stronger than an 8-character scramble, and far easier to remember. The one rule that matters most is uniqueness — never reuse a password across two accounts.
Do I still need a password manager if I use passkeys?
Yes. Passkeys roll out site by site, so for years you will hold a mix of passkeys and passwords. A manager generates and stores unique passwords for the sites that still need them, keeps recovery codes, and warns you about reuse — the part of the problem passkeys do not solve yet.
What should I actually do after a data breach?
Change the password on the affected service first, then change it anywhere you reused it, then turn on two-factor authentication. Assume the leaked password is public forever. If you reused it, check your email account too — it is the account attackers use to reset everything else.
Are free password generators safe?
They are safe when they run locally in your browser using a cryptographic random number generator (the Web Crypto API). They are not safe if the site sends your password over the network, or generates it on a server. Ours runs entirely on your device with crypto.getRandomValues().