About PasswordSecure.org

PasswordSecure.org started from a simple idea: a tool that generates passwords should not send them anywhere. That sounds obvious, but many of the ones out there load third-party scripts, advertising trackers and external fonts that log every visit.

How it works under the hood

Every calculation happens in your browser. There is no server generating anything and no database storing anything.

• Passwords use crypto.getRandomValues, the browser's cryptographic generator, with rejection sampling to avoid the modulo bias that naive % implementations suffer from.
• Passphrases come from a 7,776-word dictionary. The English one is the EFF large wordlist; the Spanish one we built from words ranked by real-world usage, without accents, so you can type the phrase on any keyboard.
• The checker queries Have I Been Pwned using k-anonymity: only the first 5 characters of the hash ever leave your browser, never the password.

Why our bit counts are lower

We calculate entropy honestly. Many tools treat a passphrase as a random character string and multiply its length by log2(58), which inflates the result roughly fourfold. A word-generated phrase only has the randomness of the word choice: number of words × log2(dictionary size).

We would rather give you a lower, true figure than a high, flattering one. And we always show the maths under the indicator, so you never have to take our word for it.

What we do not do

• No analytics of any kind.
• No tracking cookies.
• No advertising.
• No third-party resources at all — no fonts, no CDNs, no external icons.

You can verify this yourself by opening your browser's network tab. The only external request you will see is the checker's, and only if you type something into it.

Who is behind it

The site is built and maintained by MegaOryx. If you find a bug, have a suggestion, or want to report a security issue, you can reach us from there.

One thing we cannot do: recover a password you generated and lost. They are created on your device and never reach us, so no copy exists anywhere. That is precisely what makes the tool safe — and why it is worth saving whatever you generate into a password manager before closing the tab.