passgen · a password generator that stays on your machine

0 network calls 0 storage writes

Verify this page

This page is one HTML file with no dependencies. There is no server to send anything to, because the policy above forbids the browser from making a request at all. These counters come from wrappers installed on the APIs themselves, plus the browser's own refusal events.

Network calls, by the generator: 0
Blocked by policy: 0
Self-test attempts: 0
Storage writes: 0
Clipboard writes: 0
Running on origin: —

The generator itself has made no network calls. Self-test attempts are the deliberate escape attempts below; every one of them was refused. Clipboard writes happen only when you press Copy, and are counted apart from storage writes so that pressing it can never look like saving something.

Time to crack, if an attacker already holds the hash and is allowed to guess at a fixed rate. Guesses are independent, so a human who reuses a pattern beats these numbers.
Attack	Time to crack

Channels being watched

Policy in force

A hash source means the browser will only execute these exact bytes. Edit the script without rebuilding and the page stops working — that is the tamper check, not a bug.

Tries every way out — fetch, XHR, WebSocket, beacon, dynamic import, remote image — against probe.invalid, a domain reserved by RFC 2606 that cannot resolve. Each attempt should be refused and logged. Running it raises the “blocked” counter on purpose.

Check a copy of this file

Source digest for this build. If your copy of the file was edited or truncated, the digest of its source will not match.

—

What this is not

Not a password manager. It remembers nothing, on purpose: no history, no favourites, no settings, nothing in localStorage, no cookies, no service worker. Close the tab and the password is gone. Write it down, or put it in a manager you trust.

What it cannot stop: a browser extension with page access, a compromised OS, a keylogger, a shoulder-surfer, a screen recording, or a clipboard manager that keeps what you copy. Nothing rendered on a screen is private from the machine that renders it.

How to check us: open the network tab and reload: zero requests. Open the application tab: empty. Read the file — it is the program and its own source. Or run npm run verify in a clone.

Passphrase mode uses the EFF Long Wordlist. Character sets are ASCII only. No analytics, no cookies, no fonts, no CDN, no dependencies, no build step required to run this page.

This generator needs JavaScript, because the whole point is that the random numbers come from your machine's cryptographic hardware. There is no server-side fallback to fall back to.