masstree.inPassword Generator & Strength Checker
Random passwords, memorable passphrases, and an honest estimate of how long a password would survive a brute-force attack. Generated on your device only.
Runs in your browser — nothing is uploaded or stored on a server.
Generate
Choose your options and press Generate — nothing is made until you ask.
Check a password
Compares only the first five characters of a one-way hash with the Have I Been Pwned database — the password itself is never sent.
Has my e-mail been in a breach?
Lists the known data breaches this address appears in, with the date and what was exposed. The address is looked up once and not stored.
Scan into your phone clears in 60 s
Scan it with the phone camera and open the link: the password is copied straight away (on iPhone, with your first tap), and one tap anywhere saves it to Google Keep as a formatted note. The password rides in the part of the link after “#”, which is never sent to any server, and that page removes it from the address bar at once. Anyone who can see this screen can scan it too.
Good habits
- Use a different password for every account and keep them in a password manager.
- Turn on two-factor authentication for e-mail, banking and anything with a card on file.
- Length beats complexity: 16 random characters or 5 to 6 random words.
- Never reuse the password of your e-mail account anywhere else.
Questions
Is it safe to generate a password on a website?
Here, yes: the passwords come from your browser's crypto.getRandomValues, are never sent anywhere and are not stored. You can check the page source, or disconnect from the internet and it still works.
Password or passphrase?
A 16-character random password is stronger per character, but a six-word passphrase like Copper-Lantern-Falcon-Meadow-Quartz-Ember is easier to type and remember, and still has around 55 bits of entropy from this list. Use random passwords inside a password manager and a passphrase for the manager itself.
How is strength worked out?
From entropy: the length times the log of the number of possible characters, with penalties for repeats, keyboard runs and common words. Crack time assumes an offline attack at ten billion guesses a second, which is what a modern GPU rig manages against a weak hash.
Does the checker store what I type?
No. The check runs in the page with plain JavaScript and the text never leaves the input box. Still, avoid typing a password you already use into any website that is not the one it belongs to.
How does the e-mail breach check work?
The address is sent once to this site's own endpoint, which asks a breach index (Have I Been Pwned when a key is configured, otherwise XposedOrNot) which known data breaches list it, and returns the names, dates and the kinds of data exposed. Nothing is stored. If a breach exposed passwords, change that account's password and any account that shared it.