Free password tools — nothing leaves your browser
Both tools below are plain JavaScript running on your device. There is no account, no upload, no logging. That is not a promise you have to take on trust: open your browser's network panel and watch.
Password generator
Uses the Web Crypto API for randomness. Aim for 16 characters or more on important accounts.
Save it in a password manager, not in a note, a screenshot or your chat app.
Password strength checker
We estimate entropy, then penalise the patterns attackers try first: dictionary words, keyboard runs, repeats and short lengths.
How we calculate strength
Strength is not a feeling; it is roughly length × log₂(alphabet size) bits of
entropy — the number of guesses an attacker needs, on average, to find your password. We then
apply penalties for the things real attackers exploit: common passwords, dictionary words,
qwerty-style runs, repeated characters, and passwords that fall back to a single
character class.
The crack-time figure assumes a fast offline attack — someone who has stolen a password database hashed with a fast algorithm, testing 10 billion guesses per second on commodity GPUs. That is the realistic worst case for a reused password; it is why uniqueness matters more than cleverness.