About

iPassGenerator exists because generating a password should not require trusting a stranger’s server with the result.

How the tools work

Every generator on this site runs entirely in your browser using the Web Crypto API, the same primitive your browser uses for TLS. When you press generate, the page calls crypto.getRandomValues() to produce random values, and those values are turned into characters in your device’s memory.

Nothing is sent anywhere. There is no form submission, no analytics event carrying the value, no logging, and no database column for it. You can confirm this: open your browser’s network tab while using a tool and watch it stay empty. Open DevTools, go to Application → Storage, and see that nothing is written.

Correct randomness, carefully

Most “random” generators are subtly biased. Mapping a random number onto a set of characters with a modulo operation makes the first characters in the set slightly more likely than the last. We avoid that with rejection sampling: values that fall outside an even range are discarded and redrawn.

Generated passwords are then shuffled with a Fisher-Yates pass driven by the same cryptographic source, so the characters that were inserted to satisfy the “include one of each type” requirement do not sit in predictable positions.

What we do not do

We never ask for, receive or store your password.
We never claim a password is “safe” — every estimate on this site is explicitly an approximation.
We do not sell, broker or share any information about visitors.

Third-party components

The strength checker uses the Dropbox zxcvbn algorithm through a maintained TypeScript port, and the passphrase generator uses the EFF large word list. Both run locally.

Corrections

Security writing ages badly. If something here is inaccurate or out of date, please tell us and we will fix it.