Total number of characters in the generated password. The slider controls the exact count.

Includes a – z in the character pool when checked.

Includes A – Z in the character pool when checked.

Includes 0 – 9 in the character pool when checked.

Includes the full symbol set ! # $ % & ( ) * + , - . / : ; < = > ? @ [ ] ^ _ ` { | } ~ when checked. At least one character type must remain selected.

When checked, emoji characters are included in the pool as a fifth character type. Each position in the password has an equal chance of being any enabled type, so emoji slots count toward the total length. Off by default. See Shared Options — Emoji for the full pool details.

Removes the characters that read alike when a password moves between screens — 0/O and the four vertical strokes 1/l/I/| — from every enabled set. The strength breakdown states the measured cost (about 2.6 bits at 20 characters) and its remedy: one more character returns more than it takes. Off by default. These six are the tight set, the confusions that survive most fonts; the wider family (2/Z, 5/S, 8/B, 6/G, o/O) costs more than twice as much for rarer confusions and is deliberately not offered.

Total number of characters. Must be reachable by the sum of all minimums and not exceed the sum of all maximums.

Min — at least this many lowercase letters will appear.
Max — no more than this many lowercase letters will appear.
Set Min to 0 to make lowercase optional.

Same min/max controls for A – Z.

Same min/max controls for 0 – 9.

Same min/max controls for symbols. Below the sliders, individual symbol chips let you choose exactly which symbols are included in the pool:

All — activate every symbol.
Common — activate a curated subset: ! @ # $ % & * - _ + = ?
None — deactivate all but one (at least one must remain).

Toggle individual chips to fine-tune. At least one symbol must remain active when the Symbols count is non-zero.

Removes 0/O and 1/l/I/| from every set, including your chosen symbol set. If stripping would empty the symbol set (only | selected), the set is kept as chosen. The strength breakdown states the measured cost from the counts actually drawn. Off by default.

Same min/max controls as the other character types. Emoji slots count toward the total password length and are included in the min/max validation — the sum of all minimums (including emoji) must not exceed the total length, and the sum of all maximums must not fall below it.

Min defaults to 0 — emoji is effectively off until you raise the minimum or the random fill selects it. Set Min to 0 and Max to 0 to exclude emoji entirely. See Shared Options — Emoji for the pool details.

How many words are drawn from the wordlist and joined together.

The character or characters placed between each word. See the Shared Options — Separator section for the full list of choices.

Keeps 0/O and 1/l/I/| out of the random separator, prefix and suffix draws. See Shared Options — Look-alikes.

Controls how each word's letters are cased. See Shared Options — Capitalization.

Optional characters prepended (prefix) or appended (suffix) to the full password. See Shared Options — Prefix & Suffix.

Substitutes selected letters with look-alike characters. See Shared Options — Leet Speak.

When enabled, a random emoji from a general-purpose pool is prepended to each word (e.g. 🌟Flame-🌊River). Toggling it immediately rebuilds the password using the current words without re-rolling them. See Shared Options — Emoji.

After generation, each word appears as a clickable pill. Clicking a pill swaps just that word while keeping all others and the current separator/affix values — useful for quickly replacing one word you don't like without regenerating the whole password.

The lock icon beside the pills freezes the current prefix, separator, and suffix so that clicking a word pill or the "Generate" button replaces only the words without re-rolling the affixes. While locked, the strength breakdown prices the held values at 0 bits (“locked — reused, adds nothing”) — a value reused across passwords is a constant, not a secret.

Once a password is generated, a small pill badge appears inside the output field to the left of the copy button, showing the total character count of the password at a glance. The pill is hidden when the field is empty.

The passphrase is assembled from an ordered sequence of word slots (up to 8). Each slot has a type and a category:

Type	Color	Available Categories
Adj	Blue	Random, Colors, Size, Texture, Mood, Weather, Time
Adv	Teal	Random, Manner, Intensity, Time, Place
Noun	Slate	Random, Animals, Vehicles, Food, Places, Nature, Tech, Jobs, Music, Sports
Verb	Amber	Random, Movement, Action, Nature, Cognition

Each category draws from a curated list of ~100–220 words per category (2,400+ words total across all categories). The word pool is large enough that repeated words are rare even across many generations.
Slots can be added, removed, and reordered with the arrow buttons. The default structure is Adj + Noun + Verb.

See Shared Options — Separator.

Keeps 0/O and 1/l/I/| out of the random separator, prefix and suffix draws. See Shared Options — Look-alikes.

See Shared Options — Capitalization.

See Shared Options — Prefix & Suffix.

See Shared Options — Leet Speak.

When enabled, each word gets a category-matched emoji prepended — words drawn from Animals get an animal emoji, Colors get a color emoji, and so on. Toggling immediately rebuilds using the current words. See Shared Options — Emoji.

Same as in Words. Each word pill is color-coded to its slot type.

A badge inside the output field shows the total character length of the generated passphrase. Hidden when the field is empty.

Starts with Adj + Noun — a concise, memorable two-word phrase. Additional slots can be added to increase length and variety.

Hyphen — widely accepted by routers and easy to type on mobile.

Title Case — each word capitalized for readability.

None — no prefix by default.

2 Random Digits — a short numeric suffix helps meet the 8-character minimum and satisfies many router password requirements without making the phrase hard to remember.

The Alliteration toggle appears in the Word Slots card header. When enabled:

• The generator finds letters that exist in all active slot categories, then picks one at random.
• Every word pool is filtered to words beginning with that letter before a word is drawn.
• The active letter is shown as a badge on the toggle button (e.g. S).
• Clicking a word pill to swap a single word also respects the locked letter.
• Hitting "Generate WiFi Password" picks a new shared letter each time.
• If no letter is shared across all categories (rare), the constraint is silently dropped for that slot.

Alliteration produces passwords that are easier to dictate aloud: "Silent Sparrow Storm" is far easier to spell out over a phone than a random mix of words.

Same as Passphrase. Up to 8 slots; each has a type (Adj, Adv, Noun, Verb) and a thematic category.

Identical to Passphrase. Settings are stored independently under the wifi.* namespace in localStorage.

On by default here — WiFi keys get read off a router label and typed on a phone or TV remote, which is exactly where 0/O and 1/l/I/| misfire. Filters the random separator, prefix and suffix draws. See Shared Options — Look-alikes.

Same as Passphrase — each word gets a category-matched emoji prepended. Alliteration mode is respected: words are still letter-filtered, and the emoji is drawn from the word's category pool. Toggling immediately rebuilds using current words. See Shared Options — Emoji.

Each generated word appears as a clickable pill. The lock icon holds prefix/separator/suffix across word swaps and Generate, as in Words. When alliteration is on, swapped words are drawn from the same letter-filtered pool.

A badge inside the output field shows the total character length of the generated password. Hidden when the field is empty.

Choose one of 12 pre-written story templates. Each template is a sentence structure containing typed placeholders (adj, adv, noun, verb) that get filled with random words at generation time.

Name	Template structure
The Hero	The {adj} {noun} {adv} {verb} the {adj} {noun}
The Villain	A {adj} {noun} {adv} {verb} every {noun}
The Quest	{noun} {adv} {verb} beyond the {adj} {noun}
Science!	The {adj} {noun} {adv} {verb} any {noun}
Wise Proverb	A {adj} {noun} {adv} {verb} alone
Breaking News	{adj} {noun} {adv} {verb} the {noun}
Haiku-ish	{adj} {noun} {adv} {verb}
Epic Tale	{noun} and {noun} {adv} {verb} the {adj} world
Mystery	A {noun} {adv} {verb} the {adj} {noun}
Romance	The {adj} {noun} {adv} {verb} a {adj} {noun}
Sci-Fi	{adj} {noun} {adv} {verb} every {noun}
Fable	Once the {adj} {noun} {adv} {verb} alone

Literal words in the template (e.g. "the", "beyond", "alone") are included verbatim in the readable phrase preview but are not compressed into the password — only the filled placeholders are joined with the separator.

Each placeholder occurrence in the selected template gets its own category selector. When a template uses the same type more than once (e.g. two adj slots), each is listed separately and can have a different category. Category choices are the same as in Passphrase.

Joins the filled words (not the literal template words). See Shared Options — Separator.

Keeps 0/O and 1/l/I/| out of the random separator, prefix and suffix draws. See Shared Options — Look-alikes.

Applied to each filled placeholder word. See Shared Options — Capitalization.

See Shared Options — Prefix & Suffix.

See Shared Options — Leet Speak.

When enabled, each filled placeholder word gets a category-matched emoji prepended. Literal template words (e.g. "the", "beyond", "alone") are not decorated. Toggling immediately rebuilds using current words. See Shared Options — Emoji.

Shown below the word pills — displays the full human-readable sentence so you can verify or remember the password structure.

Same as in Words. Only token words appear as pills; literal template words are not swappable.

A badge inside the output field shows the total character length of the generated password. Hidden when the field is empty.

Total length of the generated numeric code.

Limits how many times the same digit may appear consecutively. For example, with a limit of 2, 33 is allowed but 333 is not. A value of 5 is effectively unconstrained for most PIN lengths.

Limits how long an ascending or descending run may be. For example, with a limit of 3, 123 or 987 is allowed but 1234 or 9876 is not. The direction must be consistent — a direction change resets the counter.

Entropy measures how unpredictable a password is: N bits means an attacker who knows your exact settings would need, on average, 2^N−1 guesses to find it. Each additional bit doubles the work. The figure counts only genuine randomness — the coin flips the generator actually made — never the length or appearance of the result. A long password built from few random choices is still a weak password, and the readout will say so.

Weak under 40 bits, fair 40–60, good 60–80, strong 80 and up. The 40-bit line is anchored to offline attacks: modern hardware can try billions of guesses per second against a stolen password database, and 40 bits (~10¹² possibilities) is roughly where that stops being quick.

The how? link under the meter itemizes every source of randomness. Options that add nothing say so explicitly — a deterministic capitalization pattern, a fixed separator, or leet substitution (a fixed mapping) each show 0 bits rather than being silently omitted.

Pick Space as your separator and the picker prices it at 0 bits; pick 1 Random Symbol and it says 4.2. Both put one character between every pair of words — so why does only one of them count?

The bits count the generator's random choices, not the characters in the output. A fixed separator is chosen once, by you, in settings: every password you generate carries a space in the same positions, so across all possible outputs there is exactly one way those positions can read — and log₂ 1 = 0. A random symbol is drawn fresh at generation time from 18 candidates, so even an attacker who knows your settings must try all 18 — log₂ 18 ≈ 4.2 bits of real guessing work.

Assuming the attacker knows your settings is the standard, safe assumption — cryptography calls it Kerckhoffs's principle. Settings make poor secrets: there are only about fifteen separator choices to sweep, versus 17,576 possibilities per word, and settings are reused across every password you make while each password's draws are fresh. If an attacker genuinely doesn't know your settings, every figure shown is an underestimate — the safe direction to be wrong in. The same rule prices custom text, literal affixes, and leet at zero: anything you typed or toggled is part of the settings, not part of the draw.

A fixed separator still earns its place — it makes the password readable and typeable — it just does not make it harder to guess. That is the same trade as Title Case: worth choosing, and honestly priced at zero.

The generator first picks a character type (uniformly among the enabled sets), then a character from that set. Entropy is therefore length × (log₂ T + mean of log₂ set sizes) for T enabled types. This is slightly less than the naive "log₂ of the combined pool" formula most strength meters use, because equal type weighting makes a digit more likely than any single letter. We display the honest, smaller number.

With a fixed count of each character type, entropy is the arrangement term (log₂ of the multinomial coefficient — how many ways the types can be ordered) plus log₂(set size) for each drawn character. When min/max ranges let the composition itself vary, the extra randomness in choosing the composition has no closed form, so the figure shown is a floor — the true entropy is at least what is displayed.

Each word drawn from the Orchard Street list contributes log₂ 17,576 ≈ 14.10 bits, so the word count dominates. A random separator or affix token is drawn once per generation and reused at every gap, so it is priced once (an 18-symbol draw adds log₂ 18 ≈ 4.17 bits, a digit 3.32 bits). The New … Each Gap separators are the exception: they redraw at every gap and are priced per gap.

Each slot contributes log₂ of its pool size — a 359-noun slot adds about 8.5 bits, a 149-adjective slot about 7.2. Grammar templates make phrases memorable, but a predictable structure means only the pool sizes count. The category pickers state each pool's size and bits up front, so a narrow category shows its price before you choose it.

Without alliteration, slots are priced like Passphrase. With alliteration, the shared first letter is one random draw (log₂ of the usable letters), and each word is then drawn from the letter-narrowed pool — much smaller than the full list. The breakdown states the cost in bits versus free word choice, so the memorability trade-off is visible, not hidden.

The repeat and sequence limits make some codes impossible and others more likely, so no simple formula applies. Instead the app replays the generator's own decision process over the finished code and computes the exact probability it had of producing it — the entropy shown is −log₂ of that probability. The breakdown reports how many bits the limits cost versus unrestricted digits.

The foot of the breakdown states the password's efficiency — total bits divided by length — next to what random characters at the same length could carry (6.26 bits each, the Simple four-set figure). A passphrase might read 2.7 bits per character against that ceiling: the gap is what structure and memorability cost, paid for with length. Slot modes also show what the same word count drawn from the flat Words list would carry (14.10 bits per word), so the two passwords that both read as “three words” stop hiding their difference.

The breakdown ends with the average time to find the password in four named attack scenarios: offline against a fast hash (a stolen database of MD5/SHA-1-style hashes, a GPU rig at ~10¹¹ guesses/second), offline against a slow hash (bcrypt or argon2, ~10⁴/second), online, throttled (a live login form, ~10/second), and online with a lockout policy (the classic domain-account rule: five wrong guesses lock the account for 15 minutes, about 480 tries a day). A single unqualified number would mislead — the same password is trivial in one scenario and infeasible in another, which is also why the 40-bit weak line is anchored to the fast-hash case. The lockout row is the argument at its sharpest: a 6-digit PIN that falls in under a second offline holds for about two years behind the lockout — which is how short PINs survive online at all, and why the offline rows are the ones that should drive your choices. Because that spread is the message, the two extremes — leaked database and lockout login — are shown right under the meter on every password, without opening the breakdown. 480 guesses a day and 10¹¹ a second are different worlds. Times are average-case and assume the attacker knows your settings.

The math: N bits means 2^N equally likely possibilities. An attacker sweeping them finds the password, on average, halfway through — 2^N−1 guesses — so the displayed time is simply 2^N−1 ÷ rate, in seconds.

Worked through for a five-word passphrase at 70.5 bits: 2^69.5 ≈ 8.3 × 10²⁰ average guesses. Against the GPU that is 8.3 × 10²⁰ ÷ 10¹¹ ≈ 8.3 × 10⁹ seconds ≈ 264 years; against bcrypt, the same guesses at 10⁴/second stretch to about 10⁹ years; online at 10/second, about 10¹². And for the weak line: 40 bits is 2³⁹ ≈ 5.5 × 10¹¹ average guesses ÷ 10¹¹/second ≈ 5 seconds on one rig — which is why 40 is where the meter starts calling a password fair.

Because the time is 2 raised to the bit count, every added bit doubles it, and ten added bits multiply it by about a thousand. That is why one extra word (14.1 bits, ×18,000) or one extra random character (6.26 bits, ×77) moves the guess time more than any tweak to capitalization or substitutions ever could.

With look-alikes excluded, the random pools shrink (lowercase 26 → 25, uppercase 26 → 24, digits 10 → 8, symbols lose |) and every draw is priced from the reduced pool. The breakdown states the total cost and its remedy — at typical settings the cost is around 2–3 bits, less than the ~6 bits one extra character returns.

Deterministic transformations add zero bits and are labeled that way: every capitalization mode except the two random ones, leet substitution (fixed mapping), fixed separators and affixes, and mirrored suffixes (a copy of characters already counted). Only new random digits inside a mirrored suffix are priced.

The math is verified two ways. In the test suite, the Numbers model is proven to be a true probability distribution by enumerating every possible output and checking the probabilities sum to exactly 1, and canary tests fail the build if a generator's code drifts from the entropy model that mirrors it. Against the running app, generated output is collected in bulk and compared to the model statistically — character-type frequencies in Simple match the displayed model (and rule out the naive combined-pool formula), every Numbers output gets a finite, matching surprisal, and Words draws match the word list's own letter distribution.

A generator is a moment-tool: you arrive, take a password, and leave. With the clipboard timer on, the only copy is gone thirty seconds later. The vault is where that password can go instead — a list of entries, encrypted as a single sealed blob in this browser's storage, unlocked with a passphrase only you know.

There is no account and no server. Nothing is uploaded, nothing is synchronised, and nobody — including us — can open your vault or reset your passphrase. That is the whole point, and it is also the whole cost: see Backups, because it means the only copy is the one you keep.

Two different things, deliberately kept apart. History is a short list of what you recently generated, encrypted with a key the browser holds for you, and it forgets on its own. The vault is a deliberate act: you name an entry and put it there, and it stays until you remove it. Turning History off does not touch the vault, and nothing in history is ever promoted to the vault without you pressing Keep.

Your passphrase is stretched into an encryption key with PBKDF2-SHA256 at 1,000,000 iterations — comfortably above the 600,000 OWASP recommends as a floor for that combination. The stretching is what makes a guessing attack expensive: an attacker with your encrypted vault file must pay those 1,000,000 rounds for every passphrase they try, which turns billions of guesses per second into a few thousand.

Because it would barely help. An attacker's cost rises linearly with the iteration count, so the strength it buys rises only logarithmically. Going from 600,000 to 10,000,000 is 16.7× the work, which is log₂(16.7) ≈ 4.1 bits — less than one extra random lowercase letter. It would cost about a second of waiting every time you unlock on a fast computer, and several on a phone.

Adding one more word to your passphrase beats it outright, and costs nothing. A word from the generator's list is worth 14.1 bits — more than three times what a sixteen-fold slowdown buys. That is the same arithmetic the rest of this page runs on: bits come from the number of random choices made, and stretching only raises the price of each guess.

It is the better algorithm, and we would rather use it. PBKDF2 is merely slow; Argon2id is memory-hard, which is what actually blunts an attacker running thousands of guesses in parallel on a graphics card — and no iteration count fixes that, because iterations raise the cost of each guess without limiting how many run at once. The obstacle is that browsers do not implement it: the built-in crypto offers PBKDF2 and nothing comparable, so Argon2id would have to arrive as a compiled WebAssembly bundle sitting in the most security-critical path in the app. For a site whose whole claim is that you can read the source, that is a trade to make deliberately rather than quietly. Each vault records the parameters it was sealed with, so switching later will not strand anything.

Entries are encrypted together as one blob with AES-256-GCM, under a random salt and a fresh random IV each time it is written. GCM is authenticated, so a vault that has been tampered with fails to open rather than opening with quietly altered contents. Nothing outside the blob reveals how many entries there are or what they are called.

In memory, only while the vault is unlocked, as a non-extractable CryptoKey — a handle the page can encrypt with but cannot read the bytes of. Locking discards it. The passphrase itself is never stored anywhere, in any form.

The iteration count is recorded inside each vault, so raising the default in a future version never strands an older vault. If yours was made at a lower count, the vault page says so and changing the passphrase re-encrypts it at the current one.

The vault locks itself after a period with no activity — 15 minutes by default, adjustable in the settings gear (Vault lock: Every page, 1, 5, 15 or 60 minutes). Locked means the key has been discarded, not merely hidden; reopening needs the passphrase again. The deadline is checked against the clock rather than trusted to a timer, so a laptop that slept through it locks on waking rather than staying open.

Within that same window, walking from the generator to the vault does not ask for the passphrase again. Making that work costs something specific and worth knowing: the vault key is written to browser storage, wrapped under a second key the browser holds, so the next page can pick it up. For the length of the window, that is a slightly weaker position than "the key exists only in memory".

Setting Vault lock to Every page switches this off entirely: nothing is stored, the key is never even made exportable, and every page asks. The same setting governs both the idle timeout and this window, so there is one number to reason about rather than two.

The password, a label for it, and — when the entry came from Keep — the exact entropy the generator computed at the time, shown as a coloured pill so a weak old entry is visible at a glance. Passwords are masked until you reveal them, and copying one starts the same clipboard-clear timer the generator uses.

A username, and any number of web addresses — one per line when editing, shown by host so a long link does not swamp the row. Both are searchable along with the label and note.

Named fields you add yourself, for whatever the account actually needs — a second login, a PIN, a customer number, a support passphrase. Mark one secret and it behaves like the password: masked until revealed, copied through the clipboard timer, and it can be generated. Leave it plain and it is just text, because hiding a customer number behind a row of dots helps nobody.

Question and answer pairs, masked and copyable exactly like the password, because that is what they are: a second password with a friendlier name. They are covered by the clipboard timer too.

The answers need not be true. Your real mother's maiden name and the street you grew up on are matters of public record; an invented answer stored here is strictly stronger, and the only reason people use the true one is that they have nowhere to keep the invented one. Now you do.

Every secret field in the vault has a Generate split button beside it: the left half runs whichever of the seven generators is in use and says which (Generate Words), and the arrow beside it opens the list to change that. It runs that generator with its own current settings — whatever the Words tab is set to is what the Words option produces here. There is deliberately no second copy of the options: one place to configure a generator, and it is that generator's tab.

Picking from the list sets the generator rather than running once with it, so there is one generator in use and the password row always shows which. The control is on every secret box for a plain reason: choosing a generator used to mean scrolling up to the password field, changing it there, and scrolling back.

The entropy comes back with the password and is stored on the entry, so something generated here carries the same exact figure as something filed with Keep — not an estimate. The two paths run the same code.

The same button sits on every security answer. An answer that came out of the generator is the strongest possible version of a field whose usual content is a fact about you that other people know.

A free-text field, not a managed folder tree. Type anything — Finance, Work, Household — and it joins the suggestions offered on every other entry. A vault of a few dozen entries does not need a taxonomy, and the cost of imposing one is that every new entry becomes a filing decision. Leave it blank and the entry sits under Ungrouped, which is a perfectly good place to stay.

Groups are the outer order, sorting the inner one — entries are sorted within their group, and the group headings appear only once something is actually filed. Ungrouped sorts last: it is where things sit when nobody has decided, and leading with the undecided pile would be an odd headline.

The group button opens a list of checkboxes, so you can show several at once rather than one at a time. Ticking nothing means all groups, not none — an empty list is never what anyone wanted. With exactly one group ticked, a new entry starts in it; with several, it starts blank, because guessing between them would be worse than not guessing.

Turn grouping off and the list becomes one flat run in pure sort order. This matters more than it sounds. With grouping on, Weakest first means weakest-within-each-group, so the worst password in the whole vault can sit halfway down the page under a heading.

A four-entry vault at 128, 56, 26 and 56 bits sorts grouped as 56, 128, 26, 56 and flat as 26, 56, 56, 128. The first is right for finding an entry you already know about; the second is right for auditing. No single default serves both, which is why it is a switch rather than a decision.

Newest first (the default, because the thing you just saved is the thing you most likely want back), Oldest first, Name, and Weakest first.

Weakest-first is the audit view: it orders by the stored entropy so the entries worth changing come to the top. Entries with no recorded figure sort to the bottom, not the top — an unknown number is not evidence of a weak password, and putting the unknowns first would bury the ones you can actually act on. Anything without a date sorts as oldest, because an entry predating the date field genuinely is.

A group is one dimension: an entry is filed in exactly one, the way a piece of paper is in exactly one drawer. Tags are as many dimensions as you like. The company credit card really is both Work and Finance, and forcing that into a single folder means losing one of the two answers. Groups still decide where the entry lives; tags describe what it is.

Lower-cased, with runs of whitespace collapsed, deduplicated and kept in alphabetical order. So Work and work are the same tag rather than two that look identical in a list. Thirty per entry, forty characters each — limits high enough that nobody will meet them by accident and low enough that a bad import cannot fill the vault with them.

This is the one thing worth stating outright, because the tag menu looks exactly like the group menu and does the opposite. Ticking two groups shows entries in either: an entry has one group, so and would always return nothing. Ticking two tags shows entries with both: an entry has many, and work plus needs-2fa means the things that are both. The menu says so above the list rather than leaving it to be inferred from the results.

Type and press Enter, or pick from the tags already in use — every existing tag is offered as a chip below the field, and clicking one toggles it. A tag on a saved entry is a button: clicking it filters the vault to that tag, which is the entire reason for having tagged anything. With tags ticked in the filter, a new entry starts with them already applied.

Tags survive the encrypted backup and the plain JSON export intact, and the CSV has a tags column of its own — space-separated, which is the shape 1Password and Bitwarden both read. Imports recognise tags, tag and labels, so a 1Password CSV arrives tagged rather than flattened.

Lose this vault and you are locked out. The seed lives only here. If this browser's data goes and there is no backup, the password is gone and so is the second factor — which is exactly the situation the second factor exists to survive. Keep an encrypted backup, and keep the provider's own recovery codes somewhere else entirely.

And it weakens two-factor authentication. A one-time code is a second factor only while it is kept apart from the first. Storing the seed in the same vault as the password collapses two factors into one: whoever opens the vault has both, and an attacker who gets in needs nothing else.

It is still a real gain against the common case — a password leaked from the site's own database, where the attacker never touches your device. And it is the same trade every password manager offering this feature makes. The difference is that here it is said before you paste the secret rather than discovered afterwards. If you would rather not make the trade, keep the codes in a separate app; that is the stronger arrangement and always was.

Paste the otpauth:// link or the base32 secret. Most sites put both behind a "can't scan the QR code?" link. The full link is better: it carries the digit count, interval and hash algorithm, so nothing has to be assumed. A secret with an invalid character is rejected rather than accepted and quietly mangled — six plausible digits that never work is a miserable thing to debug.

The current code shows on the entry with the seconds remaining, and is not masked — it expires in under a minute, and a reveal click on the one time-critical thing in the vault would be pure friction. The countdown turns amber for the last five seconds, when starting to type it is a mistake.

RFC 6238, computed with the browser's own HMAC — no dependency, nothing to trust beyond the platform. The implementation is checked against the test vectors published in the RFC itself, for SHA-1, SHA-256 and SHA-512, rather than against another implementation of the same guesswork.

If two entries share a password, both say so — a badge on the entry naming how many others use it, a summary line above the list, and a filter to show only those. Editing an entry warns as you type, before the password is filed under a second name, and names the entries it collides with.

Reuse is the failure that turns one breach into several: the site that leaks your password is rarely the site you cared about, and it hands over the one you did. It is also the only piece of password health a vault like this can assess with certainty — no guessing, no corpus, no network. It is comparing what is already in front of it.

Password1 and Password2 are two passwords, and so are Password1 and password1. There is deliberately no fuzzy matching: a near-miss flagged as reuse is a guess presented as a finding, and this page does not do that anywhere else either.

The check runs entirely in memory on the vault you have open. This is the local kind of password health; the remote kind — asking a service whether your passwords appear in a breach corpus — is on the permanent no list, along with telemetry. See Legal.

A vault living in one browser profile is one clear site data away from gone, and no account exists to recover it from. The vault page keeps a quiet line of text — not a modal — noting how many entries have been added since your last backup.

Under it is an expandable list of the last five backups: when each was made, how many entries the vault held at the time, and which browser made it. The count is what makes an old one legible — "3 entries" against today's forty says more than the date does. This record lives inside the vault, not in this browser, so every machine that opens it sees the same history; a backup made in Chrome is not reported as missing by Edge. Only encrypted backups are recorded, because a plain-text export is not a backup. It is a note that a file was made, not proof it still exists.

A .json file containing the sealed vault verbatim: still encrypted, safe to keep in cloud storage or on a drive, and restorable only with the passphrase it was made with — not necessarily the one your current vault uses. This is the backup, and it is the default.

JSON or CSV with your passwords in the clear, behind a confirmation that says so, with PLAINTEXT in the filename. This exists for one purpose — moving to a different password manager — and the file should be deleted the moment that is done.

We would rather not offer it. It ships anyway, because refusing every exit but "another copy of WordLock" is lock-in, and an escape hatch you cannot use is not an escape hatch. CSV is additionally lossy: a row is flat, so only the first web address survives and security questions are folded into the note.

Reads an encrypted WordLock backup, a WordLock plain export, or a CSV from another manager — the common header names from Bitwarden, LastPass and 1Password are recognised. Importing always merges and never deletes: entries already present are skipped, new ones are added, and restoring an old backup cannot silently wipe work done since.

This one passphrase is the only key to everything in the vault, so the page shows a live strength reading as you type it — and labels it at most N bits rather than a score. That wording is deliberate. Everywhere else on this site the entropy figure is exact, because the generator made every random choice itself and can count them. It cannot know what went into a passphrase you typed. A real attacker's dictionary knows words, names, dates and keyboard patterns that a few hundred lines of arithmetic do not, so the honest reading is a ceiling: it can tell you a passphrase is bad, never that one is good.

The reliable way out of that uncertainty is to generate a passphrase and use it, at which point the number stops being a guess.

A passphrase on the built-in list of the few hundred passwords attackers try first is rejected, not merely scored badly. Against a vault, such a passphrase is not a weak key; it is no key at all. The list is compiled offline and shipped with the site — nothing you type is ever sent anywhere to be checked.

There is no reset link, because there is nobody to send one. Forget the passphrase with no recovery key and the vault cannot be opened, by you or by anyone. Deleting it also requires the passphrase, so in practice a forgotten vault sits there until you clear this site's data in your browser. A recovery key is the one thing that changes this, and it is a key you hold rather than one we do.

A second way into the vault, for the one failure a backup cannot touch: forgetting the passphrase. The two are complements and you want both. A backup protects the data — if the device dies, the file is what brings it back. A recovery key protects access — a backup you cannot decrypt is as lost as no backup at all. Neither substitutes for the other, and a recovery key does nothing at all for a vault that was never exported and no longer exists.

How two keys open one vault. The short version: your passwords are not encrypted with your passphrase. They are encrypted with a random key, and it is that key which gets locked up — once per way in.

When the vault is created the browser generates a master key: 256 random bits, never typed by anyone and not derived from anything you chose. That key encrypts your entries, and it is the only key that ever touches them. The master key is then encrypted — wrapped — under a key derived from your passphrase, and the wrapped copy is what gets stored.

Making a recovery key wraps the same master key a second time, under a key derived from the sixteen words. So the stored vault holds three things: your entries encrypted under the master key, and two locked copies of that master key. Unlocking is the same operation either way — derive a key from whichever secret you have, use it to unwrap the master key, use the master key to read the entries.

What that shape buys, and why it is worth the extra step:

• Neither key reveals the other. Opening the passphrase copy gives you the master key and nothing else. There is no path from one locked copy to the other, so holding one does not help you find the second.
• Changing the passphrase does not invalidate the recovery key, and costs 32 bytes of work rather than re-encrypting the whole vault. The master key never changed; only the lock around one copy of it did.
• Removing the recovery key is deleting one field. Your entries and the master key are untouched — the second copy simply stops existing.
• Recovering deliberately breaks that pattern. It generates a brand new master key and re-encrypts under it, rather than re-wrapping the old one. That is the point: the forgotten passphrase’s copy does not survive, so anyone who might have learned it is locked out along with your memory of it.

The plainest way to picture it: the master key is the key to your house. You put a copy in two lockboxes, one opening to your passphrase and one to the recovery words. Changing a lockbox combination does not change the house key, and losing one combination does not matter as long as you know the other. Lose both and the house stays shut — there is no locksmith, because there is no one holding a third copy.

Drawn here from the same 17,576-word list the Words generator uses: 14.1 bits a word, 225 bits in total. There is deliberately no way to supply your own phrase, and that restraint is the whole security argument rather than fussiness.

A vault with two keys is only as strong as the weaker one, because an attacker takes whichever is cheaper to break. A memorable recovery phrase would therefore become the real strength of your vault, silently, no matter how good the passphrase was. At 225 bits of generated randomness the recovery path is not attackable at all, so the passphrase stays the binding constraint and this costs nothing. Between those two positions is a trap: anything memorable is anything guessable.

Words rather than a string of base32, because this gets written on paper and typed back by hand, months later, by someone already having a bad day. Duplicates are allowed — each draw is independent, which is exactly what makes the bit count true; removing them would look tidier and quietly lower it.

The vault stores your master key encrypted under those words, which is not the same as storing the words. There is no screen that shows it again, because there is nothing to show. Lose it and you generate another — which retires the previous one the moment it is made, so the old paper stops working.

Anyone holding those words can read every password in the vault without knowing your passphrase. Store them the way you would a spare house key: on paper is fine, inside the vault is not, and the same drawer as the laptop is worse than a different building.

Recovering asks for the key and a new passphrase together, so the vault is never sitting open with no passphrase anyone knows. Afterwards the forgotten passphrase no longer works — the vault is re-sealed under a brand new master key, so whoever might have learned the old one is locked out too — and the recovery key is spent, because it has just been typed onto a screen and possibly read aloud. Make a fresh one from settings.

Even with the vault already open. An unlocked tab proves a tab is open, not who is asking, and minting a permanent second key to someone's vault — or removing the one they are relying on — is not something a passer-by should be able to do. The same rule guards deleting the vault.

By default the vault lives in this browser's storage and nowhere else. It can instead live as a single encrypted file in a folder you choose — and if that folder is one your computer already syncs, such as Dropbox, OneDrive or iCloud Drive, then your vault is carried between machines and backed up by software you already trust, with no account here and nothing of ours in the middle.

What the file contains is the same sealed ciphertext the browser was holding. Your cloud provider learns that a file changed and roughly how big it is. It never learns what is in it, because it cannot.

Copies the vault out, reads it back to check it arrived, records the new location, and only then removes the old copy — in that order. If any step fails nothing has changed, and a folder that already holds a WordLock vault is refused rather than overwritten. Two vaults meeting is a merge, and silently replacing one with the other is the worst answer available.

The opposite operation, and how a second computer joins: it requires a vault to already be there, writes nothing at all, and only records where to look. You unlock it with its own passphrase. Deliberately a separate button from Move rather than one that guesses — a control whose destructive behaviour depends on what it happens to find is fine until the day it is not.

Saving reads what is in the folder first and merges rather than overwriting. Entries added on either machine survive, and a deletion made on one is not resurrected by the other still holding the entry. The same applies to two tabs of one browser, which is the same problem over a shorter distance.

If you both changed the same entry, it stops and asks. You get the fields that differ side by side and three choices: keep yours, keep theirs, or keep both as two entries. Nothing is written until you pick. It asks because it cannot know — the timestamps only say which was saved last, not which knew more, and an edit box open in one browser holds a copy from before the other browser saved.

What this does not cover. Two machines saving while the folder itself is out of sync — offline, or inside the seconds your cloud client takes to catch up — is resolved by Dropbox or OneDrive, not by us: they write a second conflicted copy file, which this page cannot see. Import that file and its entries merge back in.

Leaving a folder vault is not a way of deleting it. This forgets the folder on this browser and touches nothing in it: the file stays, other devices carry on, and this browser locks the vault and offers to make a new one. It asks for no passphrase, because nothing is destroyed. That is the way off a work machine or a browser you were only trying, without deleting anybody's vault and without clearing site data.

Browsers forget folder access after a restart, and a drive can be unmounted or a directory renamed. That gets its own screen saying the vault is not lost, with a Reconnect button — a button, because the permission prompt requires a deliberate click and a page that could silently reopen a folder would not need to ask. It is never reported as "no vault found", because the answer to that is an offer to create one, on top of a real vault.

Chromium on the desktop — Chrome, Edge, Brave, Opera. This needs the File System Access API to write back to a file you chose, and Firefox and Safari have not implemented it. That is unlikely to change: Mozilla's published position on the folder and file pickers is harmful. Reading a file you pick works everywhere, which is why Import works in every browser; it is writing back that has no equivalent. Elsewhere the vault stays in the browser and an encrypted backup is how it moves.

Not on phones, deliberately, even where the browser allows it. Chrome and Edge on Android both have the API, so this used to be offered there — and then asked to reconnect on every refresh — not each time you open the app, each time the page loads — and twice over, once in the page and once from Android itself. Its picker also lists local storage rather than the cloud locations your provider’s app shows, so there was nothing to sync with even after all that. A button that relocates the only copy of your vault should not lead somewhere that awkward, so it is not shown. Keep the vault in the browser on a phone, and move it with an encrypted backup.

On creating a vault the page asks the browser not to evict it under storage pressure, via navigator.storage.persist(), and shows you the answer. It asks again on every visit, because the answer can change. If the browser has not promised, the vault page says so rather than letting you find out by losing it.

Install the app. That is the reliable fix. Chrome and Edge never ask you about this — they decide, granting it once a site is installed, bookmarked, or used often enough, and reporting it as refused until then. So "denied" usually means "not yet", not "no". Use Install or Add to Home Screen in the browser menu and it is generally granted the next time you open the vault. Firefox does ask, and there the Ask again button is the request.

It is also worth knowing how unlikely eviction is. Browsers evict under genuine storage pressure, least-recently-used first, and a vault is tiny — the page shows you its size against the space available, which is typically a few dozen kilobytes against several gigabytes.

None of it replaces a backup. A promise not to evict is not a promise against a lost laptop, a reinstalled browser, or your own hand on Clear browsing data — which ignores the promise entirely. Keep an encrypted backup.

System follows your operating system's appearance setting and switches live if you change it while the page is open. Choosing Light or Dark overrides that and stays fixed.

Your choice is saved in localStorage and applies across every page. It is applied before the page draws, so switching to dark never flashes the light theme first.

Scales the whole interface, not just the text — controls, spacing and icons grow with it. Applied as a percentage of your browser’s own font size, so if you have already raised that, this multiplies it rather than replacing it. Saved across pages and applied before the page draws.

Ten accent themes, independent of Light and Dark — every one works in both. A theme changes the accent color, the focus ring and the page background. In dark mode it also tints the cards, so a violet theme is violet throughout rather than the same gray card with a violet button.

Mono is a true grayscale theme. It is the only one that also drops color from the status messages and the changelog categories, which then tell themselves apart by lightness instead of hue.

Saved in localStorage and applied before the page draws, like the others.

Marks themes whose accent stays clearly distinct from the success, warning and error colors for every kind of color blindness — protanopia, deuteranopia and tritanopia. Blue, Indigo, Violet, Slate and Mono qualify.

An unmarked theme is not a problem to use. Nothing here depends on color alone: every status message and every changelog category is labelled in words. The marker only says the color is doing useful work on top of the words.

It is measured rather than asserted. Each theme is simulated under all three deficiencies and the color distances recomputed on every build, so the marker cannot quietly go out of date. Two candidate themes were rejected by that process: an amber accent that was identical to the warning color, and an earlier, brighter red that made error messages stop standing out.

What the marker deliberately does not cover: the accent's distance from the changelog category colors and the docs badge colors. Those were measured too, and several accents sit close to — or exactly on — a family color, by design: the Sky accent is the sky badge color. That is reuse, not confusion. Status colors are signals that must be tellable apart from an interactive accent; categories and badges always carry their names in text, so hue never bears their meaning alone. A floor that failed a palette for matching its own badge would be a badly chosen floor.

Shown on the generator page only, since the other pages have no history. See Generation History for what each setting does.

Shown on the generator page only. Controls the advisory bit annotations: the ▲ vs last chip in the strength readout, the price tags on the separator, prefix, suffix and capitalization options (1 Random Symbol · 4.2 bits), and the pool sizes in the category pickers (Colors — 149 · 7.2 bits). Some people find the running commentary useful; others find it noisy. Turning it off hides only the coaching: the total, the tier, the meter and the “how?” breakdown all stay. See Strength & Entropy.

Shown on the generator page only. After you copy a password, the clipboard is wiped once the chosen delay passes. The wipe is deliberately blunt: it overwrites whatever is in the clipboard at the deadline — including something else you copied in the meantime — because checking first would mean asking permission to read your clipboard, which this site has no business requesting. It also never triggers a permission prompt of its own: where the browser allows silent clipboard writes the wipe fires right at the deadline, and everywhere else (Edge prompts for gesture-less writes) it waits for your next click or keypress, which lets the write through without asking. Off (“Keep”) by default.

On the generator page, pressing R generates a new password on whichever tab is active. It stays out of the way while any form control has focus, so typing an r into a custom separator or prefix never fires it.

Key	Action
Enter / Space	Open or close the panel
Arrow keys	Move between the options in a group
Home / End	Jump to the first or last option
Escape	Close the panel and return focus to the gear
Tab	Leave the panel, which closes it