Universal Enterprise Password Security Suite
Est. Offline Crack Time
0 seconds
Feedback
Generate a strong password first, then prove it is strong — that is the order this tool works in. The Generator tab is the default view: set a length from 8 to 64 characters, toggle uppercase, lowercase, digits and symbols, and a fresh password appears, regenerated whenever you change a setting. Bulk mode makes ten passwords at a time, or audits a pasted list line by line. Switch to the Auditor tab to check a password you already rely on: it scores it from 0 to 4 and estimates its offline crack time. Everything runs locally in your browser via the Web Crypto API — nothing you generate or type here is transmitted, logged or stored. Reusing one memorable password everywhere because strong ones are tedious to invent? This removes the excuse.
Generation is driven by crypto.getRandomValues, the browser's cryptographically secure random number generator. It fills an array with random 32-bit values from the operating system; each value picks one character from the pool your toggles define — 26 lowercase, 26 uppercase, 10 digits, 29 symbols; 91 with every set on. Because each character is an independent, uniform draw, the entropy maths is exact: length multiplied by log2 of the pool size — about 104 bits for the default 16 characters. The auditor reverses the same maths: it detects which character classes a typed password contains (counting symbols as a 32-character pool), multiplies length by log2 of the pool, and maps the result to a 0–4 score with a broad crack-time band — under 40 bits scores 1, 40 to 59 scores 2, 60 to 79 scores 3, and 80 or more scores 4.
import zxcvbn from 'zxcvbn';
function validatePasswordStrength(password) {
const result = zxcvbn(password);
// Score ranges from 0 to 4
if (result.score < 3) {
throw new Error('Password entropy too low. Add more randomness.');
}
return true;
}Yes. Everything here runs as client-side JavaScript in your own browser. An audited password never leaves the device, and a generated one exists only in this page until you copy it — refresh the tab and it is gone.
The auditor works from size, not pattern-matching: it totals the character pool your password draws from (lowercase, uppercase, digits, symbols) and multiplies length by log2 of that pool — exact for randomly generated passwords. It runs no dictionary or pattern checks, so for human-invented passwords the result is an optimistic upper bound. The maths would credit 'correct horse battery staple' with about 164 bits, but four words picked from a 7,776-word list really carry about 52 bits, at 12.9 bits per word. Discount high scores built on real words, names or dates.
Length plus genuine randomness. Each added character multiplies the search space, so a random 16-character password beats an 8-character one stuffed with symbols. Tricks that feel clever add little: leetspeak like 'p@ssw0rd', keyboard walks like 'qwerty123' and season-plus-year formulas all sit in cracking dictionaries, tried early. Reuse is the quiet killer — a strong password on ten accounts falls with the weakest site's leak. NIST guidance agrees: favour length, drop forced symbol mixtures and routine expiry, screen against breach lists.
Match the number to the attack. Behind a throttled login page, 60 bits is comfortable for an everyday account, especially with two-factor authentication on. Where an attacker can guess offline at full speed — a stolen password-manager vault, an encrypted drive — aim for 90 bits or more. And no figure rescues a password already in a breach: once it sits in a cracking dictionary its effective entropy is zero, however long it is.
No. A generated password lives only in this page's memory on your device — never sent to a server, written to an account or kept in a history, and reloading the page discards it. It leaves the tab only when you act — copy button, or pasting it into the service it was made for. Generate it, save it to your password manager at once, and it need not exist anywhere else.
Looking for more professional developer utilities?
Explore All WebToolkit Pro ToolsExpert guides and technical research related to this tool.
Free, client-side utilities related to this topic.
This generator creates UUIDs in bulk — up to 1,000 at a time, or 100,000 with bulk mode switched on — in the two versions modern systems use. UUID v4 is pure randomness: 122 random bits, no pattern, no information inside. UUID v7 keeps the same 128-bit shape but spends its first 48 bits on a millisecond timestamp, so every new ID sorts after the ones created before it. Random v4 values scatter inserts across a database index; time-ordered v7 values append neatly at its end. Pick a version, set a quantity, copy the batch — all generated locally in your browser.
Generate secure cryptographic hashes instantly using SHA-256, MD5, and SHA-512 algorithms. Verify file integrity and create secure checksums 100% locally.
Generate secure Bcrypt hashes for your application passwords. Our professional tool supports custom cost factors (salt rounds) and follows industry-standard security protocols for password storage.
MD5, SHA-256, SHA-512
Decode JWT tokens instantly
Generate v4 UUIDs
Encode binary data