How does the password generator work?
You choose length and character groups. The generator then creates a random password directly in your browser using a cryptographically secure random source.
Secure Password Generator
With the password generator you can create secure random passwords to your own requirements. Passwords are generated locally in your browser only and are neither transmitted nor stored.
Your password is generated locally in your browser only. It is not transmitted to ToolkitOne or stored.
Settings
Excludes at least l, I, O, 0, 1 and additionally o to reduce confusion.
Generated password
The rating is a mathematical estimate and not a guarantee against every attack.
Secure passwords – basics and recommendations
What makes a secure password?
A secure password should be long, random and unique. Use a different password for every service and store them in a trusted password manager.
Length instead of complicated passphrases
With randomly generated passwords, each additional character increases the number of possible combinations. Long passwords are usually much harder to guess.
A separate password for every account
Never reuse a password. If one service is compromised, attackers may try the same password elsewhere.
Use a password manager
A password manager can store and fill long random passwords so you do not have to remember each one.
Two-factor authentication
Enable two-factor authentication when a service offers it. It adds protection even if a password becomes known.
Frequently asked questions about the password generator
Are my passwords stored?
No. ToolkitOne does not store generated passwords on the server or in cookies, local storage or session storage.
Is the generated password sent to the server?
No. Generation happens locally in your browser only. There is no server-side generator endpoint.
Is the password generator cryptographically secure?
The generator uses window.crypto.getRandomValues() only, with secure selection and shuffling. An absolute security guarantee still cannot be given.
What password length is recommended?
For most accounts at least 16 characters make sense. For especially important accounts, 20 or more characters can help.
Should a password include special characters?
Special characters enlarge the character pool and can increase entropy. Length, randomness and uniqueness matter most.
Are long passwords better than complicated short ones?
Usually yes. Long random passwords typically offer far more combinations than short, hard-to-remember patterns.
What does password entropy mean?
Entropy estimates how many bits of randomness a password contains. Higher values usually mean a larger search space.
Why should I use a different password for every service?
If one provider leaks a password, attackers may try it on other services.
Can I exclude similar-looking characters?
Yes. The option excludes l, I, O, 0, 1 and o among others.
Why does the generator not work without JavaScript?
Secure generation uses the Web Crypto API in the browser. Without JavaScript no local cryptographic random generation is possible.
Should I store the generated password in a password manager?
Yes, that is recommended. You can use long random passwords for every service without memorising them.