Security & Privacy Tools
Strong passwords, hashes and encryption generated on your device.
1 tool available
About Security & Privacy Tools
Security tools are the category where the implementation details matter most, because using a compromised one is worse than using none at all. A password generated on someone else's server is a password someone else has seen.
These tools cover password generation and strength assessment, cryptographic hashing, file checksum verification, random token generation, and text encryption.
All randomness here comes from the browser's cryptographically secure random number generator, not from the ordinary pseudo-random function most naive implementations use. That distinction is the difference between a password that is genuinely unpredictable and one that merely looks scrambled. Hashing and encryption use the Web Crypto API, the same audited primitives the browser itself relies on for HTTPS.
Nothing is transmitted and nothing is stored. Generated passwords exist only in your browser tab until you copy them; refresh the page and they are gone. You can confirm this in your browser's network panel. As a general habit, though, treat any online generator with appropriate caution — for your most sensitive credentials, a dedicated password manager that generates locally and stores encrypted is the better tool, and these utilities are best for the everyday cases in between.
What makes randomness secure
JavaScript's ordinary random function is designed to be fast and statistically even, not unpredictable. Its output follows from an internal state that an attacker who observes enough values can reconstruct — at which point every future value, including your password, becomes predictable. It is entirely adequate for shuffling a list and entirely unsuitable for generating a secret.
The Web Crypto API's generator draws from the operating system's entropy pool, seeded from genuinely unpredictable physical sources. Its output cannot be reconstructed from previous values. Every password, token and key on this site uses it. If a generator does not tell you which it uses, assume the weaker one.
Length beats complexity
The familiar rules about mixing uppercase, digits and symbols produce passwords that are hard for people to remember and only marginally harder for machines to guess. Length matters far more: each additional character multiplies the search space, while substituting 3 for e adds almost nothing against an attacker whose software knows that trick.
A random sixteen-character password is beyond brute force with current technology. A four-word random passphrase is comparably strong and far easier to type. What actually breaks passwords in practice is neither — it is reuse. A strong password used in three places fails everywhere the moment any one of those services is breached, which is the case for using a password manager rather than a memorable scheme.
Frequently asked questions
Is it safe to generate a password on a website?
It depends entirely on whether generation happens on your device or on a server, and most sites do not say. Here it is local, using the browser's cryptographically secure generator, and nothing is transmitted — verifiable in your Network tab. Even so, for your most critical accounts a dedicated password manager that generates locally and stores encrypted is the better tool.
How long should a password be?
Sixteen characters or more for anything that matters, generated randomly rather than chosen. Length contributes far more strength than character variety — a long random password beats a short one with substitutions. A four-word random passphrase is a good alternative where you need to type it by hand.
Can I use MD5 or SHA-1 to hash passwords?
No. Both are cryptographically broken and neither was ever suitable for passwords, being far too fast — an attacker can test billions of guesses per second. Password storage requires a deliberately slow algorithm such as bcrypt, scrypt or Argon2. MD5 and SHA-1 remain useful only for file checksums and legacy compatibility.
Is the text encryption here strong enough for sensitive data?
It uses AES-GCM via the Web Crypto API, which is a genuinely strong, standard algorithm. The weak point is never the algorithm — it is passphrase strength and how you transmit that passphrase to the recipient. For casual protection it is appropriate; for information whose exposure would cause serious harm, use tooling designed for that purpose with proper key management.