Password Toolkit

Generate strong passwords, passphrases and PINs, get an honest read on the ones you already use, test a site's rules, lock a note with a passphrase and use the random and hashing tools. Everything runs in your browser using its secure random generator: no account, no upload, and a password you generate or type is never saved.

1. Choose a kind

The strongest per character. Best with a password manager.

For a site with special rules

20 characters with capitals, lower case, digits and symbols. Fine for almost every site.

Length: 20

Lower case (a-z)Capitals (A-Z)Digits (0-9)Symbols

More options

Leave out look-alikes (I l 1 | O 0 o)Easier to read out loud or copy from paper.Leave out awkward symbols (quotes, brackets, slashes)Safer in forms and command lines.Always include at least one of each kind chosenStart with a letterLongest run of the same characterSymbols allowedOnly ordinary keyboard symbols are used.Other characters to leave out

2. Your result

After copying, overwrite the clipboard 30 seconds later (this replaces whatever is on it by then)

Generated passwords exist only on this page. They are never saved, logged or sent anywhere, and are gone when you leave.

Your presets

Save the current settings (never a password) under a name, for the sites you use most.

Preset name

Private by design: this runs on your device and nothing you enter is uploaded. What it remembers stays in this browser. See and manage your data.

Three things worth knowing

Five or more random words make a passphrase that is easy to type and hard to guess. Use it for the few passwords you must remember.
A long random password you never have to remember beats a clever short one. Let a password manager remember it.
Never reuse a password between sites. One leak should only ever cost you one account.

Honest notes: passwords and PINs are drawn with your browser's cryptographic random generator using unbiased sampling, and the strength shown for a generated password counts only what was chosen at random. The checker is a set of rules and small built-in lists, so it can only estimate; it cannot know whether a password has already leaked, is reused, or is being watched, and it never claims a password is uncrackable. What this page saves is limited to your settings, your named presets and your habit ticks. Passwords, passphrases, the words you type for a memorable password and anything you encrypt are never stored. This is general information, not security advice for your particular situation.

Restore a backup

← Back to the product page

About Password Toolkit

Secure generators, an honest strength analyser, site-rule checker and AES encryption, in your browser.

Generate random passwords, passphrases, pronounceable passwords, PINs and memorable phrases using your browser's secure random generator with no modulo bias, and see exactly how many bits of real randomness each one carries. Check any password with a pattern analyser that explains what it found and what to change, test it against a site's rules, and lock a note with AES-256-GCM. Passwords you generate or type are never stored or sent anywhere.

What you get

Live tool at /play/password-toolkit (free, unlimited use)
Commercial license: white-label/embed this tool on your own site

Strength figures are estimates from patterns and small built-in lists; the tool cannot know if a password has leaked or been reused, and no password is uncrackable. General information, not personal security advice.

Product details, license options and more from Digital Tools →