How it works
Where the randomness comes from, how characters are chosen without bias, what entropy means, and how to check that nothing leaves your browser.
Where the randomness comes from
Every generator on this site gets its randomness from crypto.getRandomValues(), part of the Web Crypto API built into every modern browser. Browsers implement it on top of the operating system’s cryptographically secure random number generator, the same source used for HTTPS keys, password managers and disk encryption.
Key pairs, such as RSA, ECDSA, Ed25519 and the X25519 keys used by WireGuard, are created with crypto.subtle.generateKey(), which also runs inside the browser and uses the same random source.
Choosing characters without bias
Turning random bytes into characters is where many generators go wrong. The usual shortcut takes a random number and keeps the remainder after dividing by the number of characters. When the character count does not divide the range evenly, the first characters in the set come up slightly more often.
This site uses rejection sampling instead. It draws a 32-bit random number, throws it away if it falls in the uneven leftover range, and draws again. Every character in the set ends up exactly equally likely. The same method picks passphrase words, PIN digits and random numbers.
What the strength numbers mean
Each generated value shows its entropy in bits. Entropy counts how many equally likely possibilities the generator could have produced: n bits means 2 to the power of n possibilities, and each extra bit doubles the work for an attacker who has to guess.
| Entropy | Rating | What it means |
|---|---|---|
| Under 30 bits | Very weak | Guessable in seconds offline |
| 30 to 44 bits | Weak | Only safe behind strict login limits |
| 45 to 59 bits | Fair | Fine for online accounts with rate limiting |
| 60 to 79 bits | Strong | Holds up offline against slow password hashes |
| 80 to 119 bits | Very strong | Out of reach for any realistic attacker |
| 120 bits and up | Excellent | Beyond brute force, now and in the foreseeable future |
These numbers describe the generator, which is why they are exact. The password strength checker is different: it estimates the strength of a password someone typed, and that is always an estimate.
What is stored
Generated values are kept only in the page’s memory and disappear when you refresh or close the tab. The site stores a few preferences in your browser’s local storage so they survive a reload: your color mode, the cards on your board, the number of values per card, the last quick generator you used, and any options you changed on a generator page. None of these contain generated values, and they never leave your device.
If you accept analytics cookies, the site uses Google Analytics to count page views, as the privacy policy describes. Until you accept, analytics stays switched off. Either way it never receives generated values or anything you type into a tool. The generator scripts, fonts and word list are all served from this site.
Check it yourself
- Open your browser’s developer tools and switch to the Network tab.
- Press Regenerate a few times, or change any option.
- You will see no new requests. Analytics reports when a page loads, not when you generate, and the optional breach check on the password strength checker runs only when you press its button.
You can go further: load a generator page, turn off your internet connection and keep generating. Everything still works, because there is nothing to connect to.
Limits worth knowing
- A browser extension with access to all sites can read any page, including this one. Generate important keys in a browser profile without untrusted extensions.
- Malware on your device can read anything on screen or in the clipboard. No website can protect against that.
- Clipboard managers keep a history of what you copy. Clear it after copying sensitive keys.