Password security guide
Security and Privacy Methodology
Secret values are handled inside a separate self-hosted origin that has no advertising, analytics, storage or password endpoint.
Architecture and data-flow boundary
secret exists here→copy or local downloadMain site receives only height and safe action name
The main site and secure tool use different origins. Browser same-origin enforcement prevents the parent page from reading the frame DOM or JavaScript state. The parent accepts messages only from the configured secure origin and frame window, then allowlists message types.
Threat model
The design reduces exposure to content-site analytics, advertising code, ordinary page scripts, server logs and accidental URL submission. It assumes a modern browser correctly enforces origin isolation and Web Crypto. It does not defend a compromised device, malicious browser extension, hostile operating system, screen capture, clipboard monitor, phishing page or unauthorized change to the website.
Encrypted transport, server security and controlled administrative access therefore remain essential parts of the service.
Cryptographic random generation
Generators use crypto.getRandomValues(). Character selection uses rejection sampling so out-of-range random values are discarded instead of folded with biased modulo arithmetic. Group requirements are enforced by rejecting an otherwise random candidate that lacks a selected group.
Passphrase words are selected independently from the self-hosted 7,776-entry EFF long list. Strength analysis uses a self-hosted estimator. No runtime code or word list is fetched from a CDN.
What the main site can and cannot access
| Data | Main site access | Secure origin behavior |
|---|---|---|
| Generated password or passphrase | No | Held in frame memory until replaced or navigation |
| Strength-check input and result | No | Analyzed locally |
| Frame height | Yes | Sent for layout |
| Allowlisted action name | Yes | May be sent without value, score or length |
Analytics, advertising and consent boundaries
The secure origin contains no analytics, advertising or consent services. On the main website, Google Privacy & Messaging manages the consent notice for Google Analytics and Google AdSense where permission is required. These services remain outside the browser area that handles secrets.
Analytics events can describe a page or a general tool action, but they exclude secret text, generated values, strength scores, entropy results, custom character pools and URL parameters.
Browser and security-header requirements
A current browser must support Web Crypto, sandboxed frames, origin-aware postMessage and the clipboard API for copy actions. The secure origin sets a restrictive Content Security Policy, blocks framing by origins other than the canonical main site, disables unneeded permissions, blocks indexing and serves self-hosted assets only.
The main site has its own CSP and can permit consent-gated providers without adding them to the secure origin. That separation is intentional.
Responsible disclosure and verification
Report a reproducible security issue through the contact method on the contact page. Do not include real passwords, authentication cookies, private keys or personal data. State the affected URL, browser, expected behavior, observed behavior and minimal reproduction steps.
Reports are checked against the current public service. Relevant controls include cryptographic random selection, origin checks, Content Security Policy, the absence of secure-tool storage and telemetry, and correct HTTP behavior.
Known limits
No website can promise absolute safety. A strong generated password is only one control. Users must verify the correct domain, maintain device security, protect recovery channels, avoid reuse and enable modern authentication where available. The operator must protect server access, encrypted transport, backups and monitoring.