Good questions.

Yes, with Passgen. The site is just static files: once the page loads, every password is created by JavaScript running on your own device. Nothing is sent to a server, so nobody but you ever sees it.

If you want to check, load the page, turn off your internet connection, and keep generating — it still works.

No. There is no backend, no database and no analytics. Generated passwords exist only on your screen and in your clipboard if you copy them.

No cookies, no trackers, no ads. The only thing saved is your chosen settings (length, character types, theme), stored in your browser's local storage so they're remembered next time. Clearing your browser data removes them. Generated passwords are never saved.

Yes, completely free with no sign-up and no limits.

Passgen uses your browser's cryptographically secure random number generator (crypto.getRandomValues) — the same source used for encryption keys — not the predictable Math.random.

Characters are picked so that every option is exactly equally likely, and the password always contains at least one character from each type you selected.

Bits of entropy measure how many guesses it would take to try every possible password with your settings. Each extra bit doubles the number of guesses.

• Weak — under 45 bits
• Fair — 45 to 65 bits
• Strong — 65 to 90 bits
• Very strong — 90 bits or more

It assumes an attacker who has stolen a password database and can test 10 billion guesses per second offline, and shows how long it would take on average to find your password by brute force. Real attacks vary, but it's a useful comparison between settings.

"Would outlast the universe" means the estimate is longer than the universe's age of about 13.8 billion years.

Because it's long and random. A 25-letter random lowercase password has 26²⁵ combinations — far more than a 10-character password using every character type. Length adds strength faster than variety.

Lowercase-only passwords feel weak because human-chosen ones are often real words. Random strings don't have that problem. Some websites still require a mix of character types, so the generator tells you which types you've turned off.

Symbols are picked from !@#$%^&*()-_=+[]{};:,.?/~. Quotes, backslashes, backticks, spaces and angle brackets are left out because many sites reject them and they're easy to mistype.

It removes characters that are easy to confuse when reading or typing: I, l, 1, O, 0 and o. Useful for passwords you have to read out loud or type on another device.

For accounts saved in a password manager, 16–20 random characters is plenty. For something you need to remember, such as your password manager's master password, use a long passphrase of several random words instead.

Copy it straight into the site's sign-up or change-password form, and save it in your password manager. Don't keep it in a note, email or chat. Then turn on two-factor authentication for that account if it's available.

See the security tips for more good habits.

Some sites limit length or symbols. Try the Medium setting (letters and numbers only) or reduce the length to the site's maximum, then generate again.

Yes. Passgen is designed for phones first and works in any modern browser on iOS, Android, Windows, macOS and Linux.