Frequently Asked Questions

No, never. The generation process runs entirely in your browser using the standard Web Cryptography API (CSPRNG). No network requests are made during password generation, and your passwords are never transmitted or stored on any server.

The Breach Checker scans the Have I Been Pwned database using the secure k-Anonymity privacy protocol. Your password is hashed locally using SHA-1 in your browser, and only the first 5 characters of this hash are sent over the network. The database returns all matching hash suffixes, which are compared locally inside your browser tab. Your plain-text password is never sent to the network.

Entropy is a measure of randomness, expressed in bits. Higher entropy means a password is mathematically harder to guess or brute-force. A password with 80+ bits of entropy is generally considered robust against modern automated cracking attacks. Use our Entropy Calculator to measure your password's entropy.

Yes! Because all scripts and calculations are bundled into the static site assets, you can download the repository, turn off your internet connection, and run the entire suite locally. The only exception is the Breach Checker, which requires a network connection to query the Have I Been Pwned database.

Yes. GeneratePass is completely free. There are no paid tiers, no premium features, and no hidden costs. Every tool on the platform is available to everyone at no charge. We believe that strong security tools should be accessible to all users regardless of budget.

Visit our Password Generator page. Set the password length to at least 16 characters. Enable uppercase letters, lowercase letters, numbers, and special characters. Click the generate button to create a cryptographically secure random password. Copy it and store it in a password manager.

A passphrase is a password composed of multiple random words strung together, such as 'correct-horse-battery-staple'. Passphrases are easier to remember than random character passwords while still providing high entropy when enough words are used. Our Passphrase Generator uses the Diceware method with the EFF's standard word list.

Current NIST guidelines recommend changing passwords only when there is evidence of compromise — not on a fixed schedule. Instead of periodic rotation, focus on using unique, long passwords for every account. Enable multi-factor authentication wherever possible. Use our Breach Checker periodically to verify your credentials have not appeared in known data leaks.

Two-factor authentication (2FA) adds a second layer of security beyond your password. When you log in, you must provide both your password and a second verification code. This can be a TOTP app code, a hardware security key, or a biometric scan. Even if your password is stolen, the attacker cannot access your account without the second factor.

For most accounts, 16 characters provides strong security. For high-value accounts like banking and email, 20 or more characters is recommended. For password manager master passwords, a 6-word passphrase (approximately 77 bits of entropy) offers an excellent balance of security and memorability. The NIST recommends a minimum of 8 characters, but modern best practices strongly favor longer passwords.