Password Generator

How it works

1. Everything is computed locally in your browser — nothing is sent to a server
2. Your memory password should be reasonably complex, and it never changes
3. Pick one short site code per account — twitter for Twitter, facebook for Facebook

Memory passwordRequired The only one you have to remember — 8+ characters recommended

Site codeRequired Tells sites apart — one short code per site

Password length 10 characters 11 characters 12 characters 13 characters 14 characters 15 characters 16 characters 17 characters 18 characters 19 characters 20 characters

Symbols Include symbols Letters and digits only

Letter case Mixed case Lowercase only

Generated password

Strength—

Note: the same memory password, site code and options always produce the same password, on any device. Nothing is stored and no network request is made.

How to use it

1. Pick a memory password that only you know — a line from a song works well. Keep reusing it everywhere.
2. Give each site its own site code, such as twitter for Twitter or facebook for Facebook.
3. Choose the length and rules, hit Generate password, then Copy and paste it into the sign-up form.

Heads up
If you forget the memory password there is no way to recover it. Nothing is stored and there is no reset link. Avoid using this tool on shared or public computers.

How is the password computed?

The tool runs two rounds of HMAC-SHA512 over your memory password and site code to produce 128 hex characters, then maps each character onto an alphabet of letters, digits and symbols and keeps the first few characters as the result. Everything happens inside the browser; closing the page leaves no trace.

Because the derivation is deterministic, identical input always yields an identical password. That is also why a forgotten memory password or site code cannot be reverse-engineered.