Generate strong random passwords with configurable length, character sets, and exclusion rules; create memorable passphrases; check password strength; hash passwords with bcrypt/Argon2.
Character sets
Passwords are generated entirely in your browser — nothing is sent to a server. Use the strength meter and policy checker to verify requirements before using.
Generate strong random passwords with configurable length, character sets, and exclusion rules; create memorable passphrases; check password strength; hash passwords with bcrypt/Argon2.
No, with one deliberate exception: the Leak Check tab sends a 5-character SHA-1 hash prefix (never the real password) to HaveIBeenPwned's API — see the note on that tab. Every other tab is fully local.
The Leak Check tab queries the Have I Been Pwned range API using k-anonymity, so only a short hash prefix is sent, not your password.
A passphrase is several random words, easier to remember than random characters. The Passphrase mode picks 2 to 10 words from a built-in 1,024-word list, shows the estimated entropy, and the Strength Checker tab also shows entropy.
Yes. You can set the length from 8 to 128, switch uppercase, lowercase, digits and symbols on or off, and exclude ambiguous characters such as O, 0, I, l and 1.
Yes. The Policy Validator tab checks a password against rules you set, such as minimum length, minimum uppercase, lowercase, digits and symbols, maximum repeated characters, no spaces and a custom regex.