Password generator
- Random passwords from 8 to 64 characters, with your choice of upper case, lower case, numbers and symbols.
- Avoid look-alikes such as l, 1, O and 0 — handy when you have to type a password on a TV.
- Passphrases like
Otter-Canyon-Maple7-Quill-Tundra: long, strong and easy to type. - Uses your device's secure random number generator, and shows the strength in bits.
- Your preferences are remembered and used by the dice button in the item editor.
Security check
A private report on your vault, worked out on your device:
- Security score at a glance.
- Weak passwords that are short or predictable.
- Reused passwords — one breach could unlock several accounts.
- Old passwords not changed in over a year.
- Insecure websites saved with http:// instead of https://.
- Breached passwords that appear in known data breaches.
Breach checks that don't reveal your passwords
We use the Have I Been Pwned Pwned Passwords service with a technique called k-anonymity. Your browser turns each password into a SHA-1 hash and sends only the first five characters of that hash. The service replies with hundreds of matching hash endings, and your browser checks for a match locally. Neither we nor Have I Been Pwned ever see your passwords.
Questions
How long should my passwords be?
For accounts protected by a password manager, 16–20 random characters is plenty. For things you must type, a 5–6 word passphrase is excellent.
Is the security check run on your servers?
No. It runs entirely in your browser on your decrypted vault.
Passwords & notes →Store logins and private notes, sort them into folders and favourites, and find anything instantly.
Two-factor authentication →Add a 6-digit code from Microsoft Authenticator (or any authenticator app) to every login, with backup codes for emergencies.
How encryption works →Everything is encrypted on your device with AES-256 before it's uploaded. Your master password never leaves your device.