About PasswordMake

PasswordMake is four small tools — a password generator, a passphrase generator, a PIN generator, and a strength checker — with one architectural rule behind all of them: the secret you generate must never exist anywhere except your own screen.

The one rule: nothing leaves your browser

Every password, passphrase, and PIN on this site is produced by crypto.getRandomValues()from the browser's Web Crypto API — the same kernel-seeded randomness your browser uses for TLS keys. There is no generation endpoint, no request fires when you click generate, and no analytics event ever contains a generated value. You can verify this yourself: open your browser's DevTools network tab and watch it stay silent, or go offline entirely and the tools keep working.

I wrote it this way because it is the only architecture where "we don't log your passwords" is a property of the code rather than a promise you have to take on faith. I could not read your passwords even if I wanted to, and neither could anyone who compromised the server, because the server never has them.

Who makes this

I'm Luiz Torres, a software developer. I build free, client-side web utilities — this site among them — and I write the guides published here. I am not a security researcher or a certified anything; I'm an engineer who reads the primary sources and shows the math. When a guide states an entropy figure or a crack-time estimate, the calculation is in the article so you can check it rather than trust me.

You can find me on GitHub at github.com/likeknightking or email me via the contact page.

Where the recommendations come from

Nothing on this site is my opinion dressed up as authority. The advice in the tools and guides traces back to three kinds of sources: the NIST SP 800-63B digital identity guidelines (length over complexity, no forced rotation, screen against breached lists), the EFF's diceware wordlists (the standard for random passphrases, and the benchmark I compare this site's word list against), and breach data indexed by Have I Been Pwned. How I research and correct articles is documented on the editorial standards page.

How the site pays for itself

The tools are free and account-free, and they will stay that way. The site runs ads to cover hosting and my time. Ads never influence what the guides recommend — I don't sell any security product, and no password manager, authenticator app, or hardware key vendor has paid to be mentioned. Details on what the ad and analytics scripts collect are in the privacy policy.