Password Toolkit
Generate strong passwords and check their strength.
Password Toolkit combines a cryptographic password generator and an offline strength checker in one card. Generate tab builds passwords from the character sets you enable (8–64 characters, default 16) using the Web Crypto API, with an optional ambiguous-character filter for hand transcription. Strength Check tab scores any password you type — yours never leaves the device — and returns an entropy-based label plus concrete suggestions.
Both sides share the five-bar meter (Very Weak through Very Strong) and live bit readout. Everything is local: crypto.getRandomValues, no accounts, no breach lookups, no network.
How it works
Generation uses rejection sampling over Uint32Array to avoid modulo bias, guarantees at least one character from each enabled set, fills the rest from the combined pool, then Fisher–Yates shuffles. Ambiguous strip removes i, l, 1, L, o, O, 0, and | from every enabled charset.
Scoring computes entropy as length × log2(pool) over the widest classes present and maps it to labels at 28 / 40 / 56 / 80 bits. Suggestions flag short length, single character classes, and repeated characters. The estimate is an upper bound — it cannot see dictionary words or keyboard patterns.
How to use
- Open Password Toolkit (tabs: Generate, Strength Check — Generate is default).
- Read the pre-generated password in the readonly field (placeholder Press Regenerate or change an option when empty).
- Drag Length (8–64, displayed as N chars; default 16).
- Toggle Lowercase (a–z), Uppercase (A–Z), Numbers (0–9), Symbols (!@#$…), and optionally Exclude ambiguous characters (i, l, 1, O, 0, |) — options regenerate live.
- Click Regenerate for a fresh password without changing options.
- Read the meter: label + bits (e.g. 64.0 bits) across five bars.
- Click the icon Copy button (aria becomes Copied for 2 seconds).
- Switch to Strength Check, type into Password to check, and read Suggestions — helper: The check runs entirely on your device — the password is never sent anywhere.
Tips
- Copy before tweaking options — every option change silently replaces the current password; there is no history.
- Unchecking all four sets returns an empty string and a 0-bit Very Weak meter.
- Exclude ambiguous is ideal when passwords will be read aloud or transcribed by hand.
- Entropy is an upper bound (no HIBP-style breach check) — prefer length over exotic symbols alone.
Password Toolkit FAQ
Is my password ever uploaded?
No. The card says it runs all locally in your browser; generation uses crypto.getRandomValues on-device and the checker never sends the password anywhere.
How random is the generator?
Web Crypto with rejection sampling (no modulo bias) plus Fisher–Yates shuffle; tests assert varied output over many runs.
What length can I choose?
The slider allows 8–64 characters (form schema enforces that range); default is 16.
How is strength scored?
Entropy = length × log2(pool) over character classes present, mapped to labels at 28 / 40 / 56 / 80 bits.
What does Exclude ambiguous characters remove?
Exactly i, l, 1, L, o, O, 0, and | from every enabled character set.
Credits
- Web Crypto API — Cryptographically secure randomness for generation
- react-hook-form — Live option watch for the generator form
- zod — Length and character-set schema validation