01
Generation and checking stay local
Password generation uses cryptographically strong browser randomness. The checker is deliberately local and does not send your entry to Webstudiet or a breach database.
Free security tool
Create, check and share passwords more safely
Generate a cryptographically random password, inspect an existing password without sending it anywhere, or create an encrypted one-time link instead of putting a password in an email.
Encrypted one-time secret
A secret has been shared with you
Reveal it when you are ready to save it. The link is consumed when the server releases the encrypted secret, even if the connection then fails. To reload this page before revealing, reopen the original link.
Generate a password
Created entirely in your browser with the Web Crypto API. The generated password is never sent to Webstudiet.
Check a password
This local check reports length and obvious patterns. It cannot prove a password is strong or unused, and does not check breach databases. Nothing you enter is uploaded.
Enter a password to begin
Local check — nothing is sent
What this tool protects — and what it does not
02
Sharing uses client-side encryption
The server stores AES-256-GCM ciphertext, the random initialization vector and a one-way key check. It never receives the decryption key, and the tool does not collect or send a recipient email address.
03
Email is still an access channel
Anyone with the complete link can reveal the secret before it expires. For important credentials, keep the key out of the email, use a trusted password manager for ongoing sharing, and enable multi-factor authentication.
The approach follows NIST SP 800-63B-4 guidance on length, blocklists and password managers, and Web Crypto AES-GCM.