Key Cutter

Why generate passwords locally?

A password generator that runs on someone's server asks you to trust that the password shown to you wasn't logged on the way. This one can't log anything: the generation happens in your browser using crypto.getRandomValues — the same cryptographic randomness your browser uses for HTTPS — with unbiased sampling (no modulo shortcuts). Save this page and it works with the internet off, which is genuinely the safest way to generate a password.

Password or passphrase?

For anything a password manager fills in for you, use a long random password. For the few secrets a human must remember and type — your master password, your computer login — use a passphrase: five random words from the EFF's 7,776-word diceware list carry about 64 bits of entropy, stronger than Tr0ub4dor&3-style contortions and far easier to remember. The strength shown is computed from the real math, assuming the attacker knows exactly how the password was made.

Honest limitations

• Crack-time estimates assume an offline attacker at 10 billion guesses/second. Online login forms are millions of times slower — but breached password databases are attacked offline, so that's the number that matters.
• Strength math only applies to passwords generated here. Passwords you invent yourself are far weaker than their length suggests.
• Generated keys are shown once and kept nowhere — copy them into a password manager. If you don't use one yet, that's the single best security upgrade available.

Same shelf: Lock Box uses a passphrase like the ones this bench cuts to encrypt a file · Beacon turns your new WiFi password into a scan-to-join QR code so nobody has to type it.

Part of K-Engine Local Tools — free, privacy-respecting utilities that run on your device. Open source; small enough to audit over coffee. Wordlist: EFF (CC-BY 3.0). MIT licensed, from the K-Engine workshop · download the source.