About onepassword.net

What this is

15 generators for the things developers and everyone else occasionally need: passwords, passphrases, PINs, UUIDs, API keys, salts, hashes, redemption codes. All free, with no account, no rate limit, no advertising and no upsell.

Every one of them runs entirely in your browser. There is no server to send anything to, which is a fact about the architecture rather than a promise about our intentions. The privacy page explains how to verify it in about a minute.

Three rules it is built on

Most tools in this category look identical from the outside. What differs is what happens when the easy answer and the correct answer disagree. These are the three rules that decide that here, and each one is written so you can check it rather than believe it.

1. Randomness comes from one place

Every random value on this site — every character of every password, every syllable, every byte of every key — comes from crypto.getRandomValues(), through rejection sampling so that no value is more likely than another.

Math.random() does not appear anywhere in the source. That is a claim you can test: view source on any tool page and search for it.

2. Every number is either counted or labelled as an estimate

Entropy figures are easy to inflate and almost nobody checks them. So each one here says which kind it is.

The pronounceable password generator reports an exact count: its syllables are enumerated and drawn uniformly, and a generated password can be split back into syllables exactly one way, so the possibility count is literally 285ⁿ × 23. The unit tests assert that round trip rather than assuming it.

The strength checker reports an estimate, and says so. It also publishes the four categories of weakness it cannot detect, along with the name of the library that does detect them and how much larger that library is.

3. Saying "you do not need this" beats saying something impressive

The salt generator opens by telling you that if you use bcrypt or Argon2, the library already made your salt and this page has nothing to give you. That is most of its likely audience.

The PIN generator filters out predictable PINs, and then states that the filter makes the draw very slightly less uniform: against an attacker who knows the filter is on, three guesses go from 0.0300% to 0.0308%. Leaving that out would have been easier and would have been dishonest.

Where a source could not be read and verified, it is not cited — even when it was exactly on topic. Three well-known references were dropped for that reason, and each page says which.

What it deliberately does not do

• Store anything. No accounts, no history, no saved values. A tool that could show you last week's password would be a tool that kept it.
• Hash your files. Your operating system does that better, offline, without a web page in the middle.
• Offer a password manager. Generating a strong password is the easy half. Keeping it is a different product and a much larger responsibility.
• Publish an API. An API means a server, and a server means your values travelling somewhere. That trade is not worth making.
• Show ads or invent ratings. No advertising, and no fabricated star ratings in the structured data — a practice common enough in this category to be worth naming.

Who makes it

This is an independent project, published without a byline. That is deliberate: a name in a byline is not something you can verify, and this site's credibility is meant to rest on things you can — the arithmetic is reproducible, the sources are linked and quoted, and the code that produces every number is readable in the page.

Where a figure comes from somewhere else, the page names the specification, the paper or the dataset and links to it. Where a figure was computed here, the page says that too, and a unit test holds it to that value.

OnePassword.net is an independent free online generator toolkit. It is not affiliated with, endorsed by, or connected to 1Password or AgileBits, Inc.

When something is wrong

Some of it will be. If a number is wrong, a citation has rotted, or a page misbehaves on your device, that is worth an email — see Contact. Corrections are made to the page and the date at the top changes with them.