Security Suite · v4.2
Generate, analyze and vault cryptographically secure passwords and passphrases — entirely in your browser. Zero servers, zero tracking, AES-256 encrypted history.
Hardware-backed randomness, tuned to your policy
Real-time analysis of the current password
Paste any password for a deep forensic breakdown. Nothing leaves your device.
| Attack model | Speed | Time |
|---|---|---|
| Online throttled attack | 100 guesses / s | — |
| Offline GPU cluster | 10 billion / s | — |
| Hypothetical quantum farm | 1 trillion / s | — |
AES-256-GCM · PBKDF2 210k iterations · auto-locks when you leave the tab
Enter your vault passphrase to decrypt history.
Choose a strong passphrase. It encrypts all history locally — we never see it.
No entries yet. Generate a password and press Ctrl+S to save it.
Provision up to 500 unique credentials at once, then export in any format.
| # | Label | Password | Entropy | Actions |
|---|
Put two candidates side by side and let entropy decide.
Enter two passwords to compare.
Anonymous, session-scoped metrics. Cleared when you close the tab.
Memorable word chains with serious entropy. Length beats complexity.
One-click configurations aligned with NIST SP 800-63B guidance.
16 characters, all sets, no ambiguous glyphs. The modern baseline.
20 characters with full charset. Safe against offline captures.
24 characters, guaranteed sets, lookalikes removed for teller entry.
32 characters of pure entropy for root, SSH keys and CI secrets.
Pronounceable 14-char base with digit & symbol caps. Human-friendly.
64 characters, every set enabled. Post-quantum peace of mind.
Each extra character multiplies the search space. A 20-character mixed password has more entropy than an 8-character one with every symbol on the keyboard. Aim for 16+ everywhere.
Credential stuffing automates breach replay: one leaked password unlocks every account that shares it. Every account deserves its own generated secret.
Four random words from a 400-word list give ~34.6 bits per word. Six words ≈ 208 bits — stronger than most 16-char random strings and far easier to type on a phone.
A perfect password still falls to a phishing page. A second factor — preferably a passkey or hardware key — turns stolen credentials into dead ends.
“P@ssw0rd!” looks complex but scores near zero: it is a dictionary word with predictable substitutions. Attackers normalize l33t-speak before cracking.
Rotate credentials for financial and admin accounts every 90 days, immediately after any disclosed breach, and whenever your vault flags a weak entry.
Yes. Every value is drawn from window.crypto.getRandomValues() with rejection sampling to remove modulo bias. Math.random() is never used anywhere in this application.
No. Generation, analysis, history and exports all run locally in your browser. There is no network call in the entire tool — you can verify it in your DevTools Network tab.
Your vault passphrase is stretched with PBKDF2-SHA256 (210,000 iterations, random salt) into an AES-256-GCM key. Each save uses a fresh random IV. Without your passphrase the blob is noise.
Because encryption is zero-knowledge, the data cannot be recovered. You can reset the vault, which permanently deletes the encrypted history on this device.
The key lives only in memory. Switching tabs or hiding the window wipes it, so a shared or stolen device never exposes decrypted entries.
We assume half the keyspace must be tried: 2^(entropy−1) guesses at 100/s (online), 10¹⁰/s (offline GPU) and 10¹²/s (hypothetical quantum). Real attacks add dictionary shortcuts, which is why pattern penalties matter.
Yes — export the vault as JSON on device A, import it on device B and decrypt with the same passphrase. Entries merge by ID without duplicates.
Ctrl+G generate · Ctrl+Shift+C copy · Ctrl+S save to vault · Ctrl+K analyzer · Ctrl+B theme · ? full list.