Questions, answered
These are the things a careful user should ask before using any password tool: where the phrase is made, what the entropy means, when to use it, and when a password manager or passkey is the better choice.
Yes, as a generator. It uses your browser's Web Crypto API for secure randomness and picks each word uniformly from the list. The important part is what you do next: use a unique passphrase for each important secret, and turn on passkeys or two-factor authentication wherever possible.
No. The passphrase is generated inside your browser. Clicking Generate does not call a server, create an account, or store the passphrase in cookies or local storage. The only local storage used by the site is your light/dark theme preference.
The default is 6 words plus a random 0-99 number, which is about 64.5 bits with the current 800-word list. For a password manager master password, device encryption password, or anything high value, choose 7 or 8 words. For ordinary website logins, a password manager can usually create and store a unique random password for you.
It means the generator has about 2^64.5 possible outputs for the default settings. That is a measure of guessing difficulty, not a guaranteed crack time. Real-world safety also depends on where you use it, whether the site rate-limits guesses, and whether you reuse it anywhere else.
No. Use passkeys when a service supports them. Use a password manager for most accounts. This tool is best for passphrases you may need to remember or type yourself, like a password manager master password, device login, Wi-Fi password, recovery phrase label, or one account where a memorable secret matters.
No. A strong reused passphrase becomes weak the moment one site leaks it. Use one unique secret per account. If you need many account passwords, let a password manager generate and remember them.
Random words do most of the security work. The optional number and symbol add some extra combinations and help with sites that require them. Separators and normal capitalization mostly help readability and compatibility; they should not be treated as the main source of strength.
Try a different separator, add the number or symbol option, or reduce spaces. If a site has a short maximum length, use the longest unique password it allows and store it in a password manager. Do not reuse a shorter memorable phrase across multiple sites.
Save it in the place you actually trust: usually a password manager, or a secure offline record for a device or vault password. Be careful with screenshots, chat apps, shared clipboards, and screen sharing. The website does not save the phrase, but your operating system clipboard may keep it briefly.
The current wordlist has exactly 800 everyday Hinglish words: Hindi words written in the Latin alphabet, plus familiar Indian-English words. It focuses on words that are easy to read, type, and remember.
No. Security comes from random selection from a known list, not from hiding the language. A public 800-word list is fine as long as the passphrase uses enough random words. Hinglish is a usability choice: it should feel natural for users who already think and type this way.
Yes. Repeats are allowed on purpose. Each word is picked independently, so a repeated word is not a bug or a weakness. It is part of the same math used by Diceware-style passphrases.
Yes. Open your browser developer tools, go to the Network tab, and click Generate. The generation action should not create a network request. You can also inspect the source code because the project is open source.
The score is based on your settings, not on whether a particular phrase looks funny, simple, or complex. Six random words from the same 800-word list have the same entropy as another six random words from that list.
No, and it does not need to be. A passphrase generator should be safe even when the attacker knows the wordlist and the method. The secret is the random choices your browser makes on your device.
