valsec.pro

Password Generator

Create strong, random passwords and instantly check whether they’ve appeared in a known data breach — all privately, in your browser.

Generated locally · never uploaded
Generated password
—
Options
Breach check (Have I Been Pwned)

Check any password against 900M+ breached passwords. Only the first 5 characters of its hash are sent — never the password itself.

How it works

Every password is produced with your browser’s cryptographically secure random number generator (crypto.getRandomValues) from the character sets you choose. Nothing is generated on a server, so there is no password to intercept, log or leak.

The optional breach check uses the Have I Been Pwned k-anonymity API: your password is hashed with SHA-1 locally, only the first five hex characters of the hash are queried, and the matching suffixes are compared on your device. The service never receives your password or its full hash.

Frequently asked questions

Are the passwords generated securely?
Yes. Passwords are generated in your browser using crypto.getRandomValues(), a cryptographically secure random source. They are never sent over the network or stored anywhere.
How does the breach check work without leaking my password?
It uses the Have I Been Pwned k-anonymity model. We hash your password with SHA-1 locally, send only the first 5 characters of the hash, and compare the returned suffixes on your device. Your full password and full hash never leave your browser.
What makes a password strong?
Length matters most. A longer password with a mix of upper- and lower-case letters, digits and symbols has more entropy, making it exponentially harder to crack. Aim for 16+ characters for important accounts.
Should I reuse passwords?
Never. Use a unique password for every account and store them in a password manager. If one site is breached, unique passwords keep the rest of your accounts safe.

Related tools

Password Strength Hash Generator WebRTC Leak Test