What this is

WordLock is a password generator that runs entirely in your browser. It offers seven ways to build a password — Simple, Advanced, Words, Passphrase, Wireless, Mad Lib and Numbers — from single random characters through to memorable word-based passphrases.

Nothing you generate is sent anywhere. There is no account and no server to talk to: the site is plain HTML, CSS and ES modules, with its one library vendored into the repository rather than fetched from anywhere. What a server sends you is what is in the repository — nothing is bundled, minified or assembled on the way. See Legal for the full privacy statement.

There is also a vault, because a generator on its own is a moment-tool: you take a password and leave, and the clipboard timer erases the only copy thirty seconds later. The vault keeps what you generate, encrypted with a passphrase only you know. It has no account for the same reason the rest of the site does not — there is nothing here to sign in to. That means backups are yours to keep, and that nobody here can let you back in: there is no password reset, because there is no account to reset. What there is instead is a recovery key — sixteen words, shown once, that you keep somewhere safe and that open the vault when the passphrase has gone. Lose the passphrase and that as well, and the vault is gone for good. Which is the honest cost of the arrangement rather than an oversight. The documentation explains how it is encrypted and what it does not protect against.

It can sync between your computers, but not through us. The vault can be kept as a single encrypted file in a folder you choose, and if that folder is one you already sync — Dropbox, OneDrive, iCloud Drive — then your own software carries it, using an account you already have with a company you already chose. We are not in the middle of that, and could not be: this site still has no server to put there. Your provider stores ciphertext it cannot read.

The generator stays the front door and stays complete on its own. Growing a vault beside it was a deliberate decision, made on the condition that neither of those changes.

Why word-based passwords

A passphrase drawn from a large word list can be far easier to remember than a random string while remaining hard to guess — the strength comes from the size of the pool a word is drawn from, not from how complicated the result looks. The Words mode draws from the Orchard Street Long list of 17,576 words — about 14.1 bits per word, so a five-word passphrase is already past 70 bits. It replaced the 7,776-word EFF list, which was built for physical dice; this one is built for software, and no two combinations of its words can be read as a different set of words, which matters if you turn the separator off.

Randomness

Every random value comes from the browser's crypto.getRandomValues(), drawn with rejection sampling so that each character or word in a pool is equally likely. Earlier releases used Math.random(), which is not cryptographically secure; that changed in v2.7.2. If you generated passwords before then, they are worth regenerating.

Credits

Made by Raymond Tetzloff, with assistance from Bolt and Claude Code, and hosted on Render.

The source is on GitHub. Third-party components and their licenses are listed on the Legal page.

Elsewhere

Anagrimoire is a companion set of word-game solvers and daily puzzles by the same author. It shares this site's approach: it works without an account, and nothing you type into a solver leaves your device.