Randomness is easy to get subtly wrong. The textbook way to pick a random item — take a random number and use the remainder after dividing by the list length — slightly favours some items over others, and the standard Math.random function in browsers is not designed for anything security-related. Every tool in this section draws from the browser's cryptographic random number generator and uses rejection sampling, so each possible outcome is exactly as likely as every other. The pages explain how, because "trust me, it is random" is not an explanation.
Generated secrets never leave the page
A password generator that runs on a server has, by definition, seen your password. The generators here run in your browser, and nothing they produce is sent, logged or stored. Close the tab and it is gone. The same applies to the hash generator: files are read and hashed locally, which is the only sensible way to check a large download or a private document against a published checksum.
Measuring strength honestly
Password strength meters often reward the wrong things, like a single symbol in an otherwise predictable word. The password generator measures strength as entropy — how many equally likely passwords the settings could have produced — and converts it into a rough time to guess under a stated, deliberately pessimistic assumption about the attacker. That makes the effect of each setting visible: adding four characters does more than adding symbols.
- Password generator: random passwords with configurable character sets, and passphrases built from the EFF word list.
- Random picker: draw names, shuffle a list, split people into balanced teams, or spin a wheel for the room to watch.
- Hash generator: MD5, SHA-1, SHA-256, SHA-384 and SHA-512 for text and files, with automatic comparison against an expected value.
MD5 and SHA-1 are included because many download pages still publish them, not because they are secure. The hash page explains which algorithms are appropriate for which purpose.
What makes a password strong
A generated password is strong because of its length and randomness, not because of the mix of character types. Each character drawn from all 94 printable characters adds about 6.55 bits, while adding symbols to a 12-character password of letters and digits adds only about 7 bits in total. The guide to passwords that last explains this arithmetic, summarises what NIST SP 800-63B-4 now requires — at least 15 characters for a password used on its own, no composition rules and no forced periodic changes — and explains where hashes fit in: checking downloads, not storing passwords. It also covers why the same random source that makes a password unguessable makes a draw fair.
Options that make passwords easier to use
Two settings exist for practical reasons. Avoiding look-alike characters removes 0, O, o, 1, l, I and a few easily confused symbols, which helps when a password has to be read aloud or typed from paper; it shrinks the alphabet from 94 to 84 characters, a loss that a single extra character more than makes up for. Requiring every selected type guarantees at least one digit and one symbol for sites that still insist on them.