The tool
Key
A password generator that never phones home. Every secret below is drawn by your own browser’s cryptographic random source and never leaves it — no network calls, no analytics, no storage.
Where the randomness comes from
Every draw goes through crypto.getRandomValues — your
operating system’s cryptographic random source, reached through the
browser. Characters and words are picked by rejection sampling, so no
character is ever more likely than another and no word is ever favoured
over another. Math.random() appears nowhere on this page; it
is seeded, predictable, and has no business anywhere near a credential.
Entropy, counted honestly
A 32-character URL-safe password carries about 193 bits — far past the reach of any brute-force attack that will ever exist. A six-word passphrase from the EFF Large Wordlist carries roughly 12.9 bits per word: 77.5 bits at six words, which is the level that resists offline cracking on serious hardware, and it is far easier to type on a phone or read aloud over a call.
When require every class is on, the meter does not report the naive figure. Rejecting every candidate that misses a class shrinks the set of possible passwords, so the honest number is the base-2 logarithm of the accepted count — computed exactly, by inclusion–exclusion. Composition rules make short passwords slightly weaker, and the gauge says so.
Nothing leaves this page
This page is not part of the site’s app framework. It is plain HTML, CSS, and one script — served under a policy that forbids every outbound request: no fetch, no beacons, no fonts or scripts from anyone else’s server, ever. There is nothing to opt out of, because there is nothing collecting. The wordlist is built into the page, so you can save this file, disconnect entirely, and it still works.
We build tools the way we build games: no ads, no telemetry, no farming your attention. You should not have to take that on faith — read the source, or open your browser’s network tab and watch it stay empty.
The same generator, in your terminal
Key is the web build of password-key, our open-source Python package — MIT licensed, zero runtime dependencies, and published to PyPI through signed, trusted publishing.
pip install password-key
pwk # 32-char URL-safe password → clipboard
pwk --words 7 # 7-word EFF passphrase