Independent password security
Weak passwords are still the cheapest way into your accounts
Check how strong a password really is, generate one you can trust, and follow plain-English guides for locking down email, banking and work accounts. Every tool runs in your browser, nothing you type is sent, logged or stored.
Free tools, no strings
Client-side only. No accounts, no tracking pixels, no "sign up to see your result".
Latest guides
Explained from first principles, with sources you can check.
What to Do After a Data Breach: A Timed Response Checklist
Know what to do after a data breach with this timed response guide, first 15 minutes, first day, and first week actions to stop the damage spreading.
Passkeys vs Passwords: What Actually Changes for You
A plain-English guide to passkeys vs passwords: how the key pair works, why phishing fails, what to do if you lose your device, and how to start migra
Password Manager Buying Guide: What Actually Matters
Our password manager buying guide covers zero-knowledge encryption, passkey support, breach monitoring, and what to verify before trusting your vault.
From the blog
Twice a week: what has changed, and what to do about it.
Router Default Password: Change It Before Anything Else
The router default password is the first thing attackers try. Change it, update your Wi-Fi passphrase, and lock down your network in under 15 minutes.
Passphrase vs Password: The Maths That Settles It
Passphrase vs password: compare entropy, attack resistance, and real-world use. Exact bit counts, NIST guidance, and a clear rule for when to use each
How to Audit Passwords in One Sitting: Step-by-Step
Learn how to audit passwords in under two hours. Find reused, weak, and breached credentials with a password manager and Have I Been Pwned.
Why this site exists
Most password advice is either vague ("use a strong password") or trying to sell you something. This site does the opposite: it shows you the maths behind a password's strength, tells you which habits actually matter, and keeps the tools free and private. We earn from affiliate links when we recommend something we would buy anyway, and every one of those links is labelled.
Common questions
Is it safe to type my password into this site?
Yes, and you can verify it yourself. Every tool on this site is JavaScript that runs inside your browser; the password you type is never sent to our server, logged, or stored. Open your browser's developer tools and watch the network panel: no request carries your input. If you would rather not type a real password at all, test a variant with the same length and character mix.
How long should a password be in 2026?
Use at least 12 characters, and 16 or more for anything that protects money, email or identity. Length beats complexity: a 16-character passphrase of ordinary words is stronger than an 8-character scramble, and far easier to remember. The one rule that matters most is uniqueness, never reuse a password across two accounts.
Do I still need a password manager if I use passkeys?
Yes. Passkeys roll out site by site, so for years you will hold a mix of passkeys and passwords. A manager generates and stores unique passwords for the sites that still need them, keeps recovery codes, and warns you about reuse, the part of the problem passkeys do not solve yet.
What should I actually do after a data breach?
Change the password on the affected service first, then change it anywhere you reused it, then turn on two-factor authentication. Assume the leaked password is public forever. If you reused it, check your email account too, it is the account attackers use to reset everything else.
Are free password generators safe?
They are safe when they run locally in your browser using a cryptographic random number generator (the Web Crypto API). They are not safe if the site sends your password over the network, or generates it on a server. Ours runs entirely on your device with crypto.getRandomValues().