Our Story

PasswordGenerator.now started with a simple irritation. Most "free password generators" were ad farms that sent your freshly minted password through their servers - Or put a signup wall in front of a feature browsers can do natively. We thought a password tool should behave like a good lock: simple, transparent and entirely in your hands.

So we built it differently

So we built one that runs 100% client-side. Then we kept going: a passphrase generator, a strength checker, a full 2FA toolkit with a free developer API, and an encrypted Password Wallet that we ourselves cannot read.

• Secrets stay on your device. Generation, checking, hashing and encryption all run in your browser via the Web Crypto API. Turn off WiFi and the tools still work.
• Zero-knowledge where storage is needed. The Password Wallet stores only ciphertext encrypted with keys derived from your master password.
• Free means free. No trials, no seat limits, no "premium strength".
• Teach, don't scare. Our security guides explain the real math and real attacks, without FUD.

Every generator and checker on this site runs on the browser's own cryptography: crypto.getRandomValues() for randomness (with rejection sampling so there's no modulo bias), the Web Crypto API for AES-256-GCM, PBKDF2 and the SHA-2 family, and plain JavaScript you can read in your devtools. There is no server-side generation endpoint at all - The pages work offline once loaded.

Where storage is unavoidable, we go zero-knowledge: the Password Wallet derives two keys from your master password on your device, encrypts every item with AES-256-GCM before upload, and sends us only ciphertext plus a hash of a separate authentication key. A copy of our database would contain nothing readable.

The 2FA API is deliberately stateless: TOTP secrets are used in memory to compute or verify a code and are never written to disk or logs.

The security guides follow three editorial rules:

1. Numbers need named sources. Crack-time tables and breach statistics cite NIST SP 800-63B, the Verizon DBIR or Have I Been Pwned - Or they don't go in.
2. Advice tracks current standards, not folklore. No forced 90-day rotation, no mandatory-symbol rules - the standards abandoned them.
3. Guides match the tools. Every guide is reviewed against the software it links, so what we recommend is what our tools actually do.

Spot an error? Tell us - Corrections ship fast.