SHA Hash Generator
Security Local only
Password Generator & Security Lab
Local onlyCreate passwords, passphrases, PINs, and random tokens with Web Crypto, then inspect strength locally.
Secrets are not persisted
Generated secret
Uniform random characters from the policy's legal sample space.
Web CryptoLocal only
A secure result will appear here.
Length
—
Random entropy
—
Strength
—
Random space
—
Random password policy
Longer passwords usually matter more than mechanical composition rules. Use constraints only when the destination requires them.
How to use it
- 01
Choose a secure mode
Generate a random password, EFF passphrase, numeric PIN, or byte-based secret token using browser Web Crypto.
- 02
Tune the real policy
Set length, character classes, exclusions, fixed text, word count, or token encoding while seeing honest entropy limits.
- 03
Copy or inspect
Copy the in-memory result, generate a local batch, or explicitly analyze a password and optionally query HIBP by hash prefix.
Frequently asked questions
Are generated passwords uploaded or saved?
No. Generated passwords, passphrases, PINs, tokens, and batch results remain in memory and disappear on refresh. Only non-secret settings may be saved locally.
Why does the generator require Web Crypto?
Web Crypto supplies a cryptographically strong random source. Nobuf disables generation when it is unavailable and never falls back to Math.random.
How long should a password be?
There is no universal length for every system. The default is 20 random characters; current NIST guidance calls for at least 15 characters for a single-factor password and support for at least 64.
What is the difference between a password and a passphrase?
A random password selects characters, while a passphrase selects independent words. A sufficiently long random passphrase can be easier to enter while retaining a large search space.
What does entropy mean here?
For tool-generated values it describes the actual random selection space. It is not applied as a simplistic formula to human-created passwords, which are analyzed for patterns instead.
Does the breach check send my complete password?
No. It runs only when requested, hashes the complete password locally, and sends the first five SHA-1 hash characters to the HIBP range service with response padding.
Does no breach match mean the password is safe?
No. A non-match only means the password was not found in that data response. Strength, uniqueness, device security, and the service’s password storage still matter.
Does this replace a password manager?
No. This tool creates and analyzes secrets but deliberately does not keep a password history, synchronize secrets, or manage account credentials.
Related tools
Keep working with other private browser utilities.