A few weeks ago I wrote about the crypto behind my password generator — rejection sampling, a Fisher-Yates shuffle driven by the Web Crypto API, and honest entropy math.
That post became a full tool site: SecurePass Gen. This week I shipped 4 new tools on it. Every one of them runs 100% client-side — no account, no server, no data leaving your device. Here's the thinking behind each one.
1. Memorable Password Generator
The industry advice "just use a random string like xK29!fQz" fails one test: humans. People write gibberish on sticky notes or reset it every month.
A passphrase solves this differently. A tool like the Memorable Password Generator picks 4–5 random words from a wordlist and joins them: Brave-Tiger-Storm-42.
The math: 5 words drawn from a 1,000-word list gives you about 50 bits of entropy — comparable to a 9-character random password, but something your brain can actually hold at 3 AM.
The critical detail: the words must be picked by a secure random generator, not by you. Humans are terrible at randomness — we gravitate to pet names and birthdays, which live in every cracking dictionary.
2. 8-Character Password Generator
Some systems still cap passwords at exactly 8 characters — legacy portals, router admin panels, IoT setup screens. When a cap is enforced, variety is all you have left.
I put the honest math on the 8-character generator page. Eight characters, three levels of variety:
- Lowercase only: about 200 billion combinations — cracked in seconds.
- Letters + digits: about 200 trillion — cracked in hours.
- Letters + digits + symbols: about 7 quadrillion — years on average.
Same 8 characters. The difference between "seconds" and "years" is purely character variety. And if the site allows more than 8 — take them, every extra character multiplies the search space for free.
3. Password Strength Checker
Here's a thing that still bugs me: most online "password checkers" ask you to paste your real password into a stranger's web form. Some of them send it to their backend "for analysis."
So the Password Strength Checker computes everything in your browser — entropy in bits, estimated crack time, and pattern warnings (dictionary words, repeats, sequences, letters-only). Open your network tab while typing: there is no request to intercept, because there is no backend.
My suggestion for how to use it safely: test a pattern, not your real password. Try a password shaped like yours, see what the checker flags, then apply the lesson.
4. WiFi Password Ideas
Your WiFi password has a unique job: it gets spoken aloud across the room and typed on a guest's phone. It needs to be strong and sayable — a rare combination.
The WiFi Password Ideas page covers patterns like Copper-Maple-Rocket-71 (four random words plus digits), WPA2/WPA3 minimums, why WPS should be off, and why your guest network should have a different password from your main one.
The pattern across all four
One design rule drove everything: if a feature would need a server, it doesn't ship. That constraint killed every dark pattern before it could exist — no password ever touches a network. No analytics on keystrokes. Nothing to leak, because there's nothing stored.
All four tools are live at mypasswordgen.com — free, no signup, and they keep working once the page loads.
What would you add next? I'm collecting ideas for tool #5.
Top comments (0)