How SecurePassLab Works
SecurePassLab is designed so the core password tools run in your browser. This page explains what the code does, what stays on your device, and what the tools cannot promise.
1. Random numbers come from the browser
The generator uses the Web Crypto API's crypto.getRandomValues() rather than Math.random(). The code also uses rejection sampling when mapping random 32-bit values into smaller ranges, avoiding simple modulo bias.
That matters because the entropy estimates shown by the site assume the generator's choices are independent and approximately uniform.
2. Passwords and passphrases use different random pools
Random-character passwords are assembled from the character types you enable. Passphrases select words from a 2,048-word English BIP39 word list. In the custom builder, random words, digits, symbols, and characters contribute randomness; fixed text and separators do not.
For example, five independent selections from 2,048 equally likely words provide 55 bits of theoretical selection entropy because log₂(2,048⁵) = 55.
3. Generated secrets are not intentionally sent to a SecurePassLab server
Generation occurs in the browser and the current implementation does not make a server request containing the generated password or passphrase. Results exist in the page's memory until you regenerate, reload, or leave the page.
If you copy a password, it enters your device clipboard. Clipboard history, browser extensions, malware, screen capture tools, or other local software may be able to access it. Client-side generation cannot protect a compromised device.
4. Optional preferences stay in local storage
If “Remember my settings” is enabled, settings such as length, enabled character groups, separators, and custom pattern configuration can be stored in your browser's local storage. Generated passwords are not intentionally saved there.
Fixed text used in a custom pattern can be part of the saved configuration, so do not use an existing password or other secret as fixed text.
5. Strength and crack-time numbers are models, not promises
Entropy values describe the number of possibilities under the generator's stated assumptions. Crack-time examples depend on an assumed guessing rate and average search position. Real attacks vary with password storage methods, hardware, rate limiting, credential leaks, phishing, malware, and attacker knowledge.
The password-strength checker is a local educational heuristic. It cannot tell whether a real password has appeared in a breach, whether your device is compromised, or whether an account's recovery process is secure.
6. Analytics are kept separate from password inputs
SecurePassLab uses Vercel Web Analytics for aggregate traffic and page-view information. The site does not intentionally create analytics events containing generated passwords, strength-checker samples, or custom pattern text. See the Privacy Policy for more detail.
What SecurePassLab cannot protect against
- Phishing or entering a password into the wrong site.
- Malware, malicious browser extensions, or a compromised operating system.
- Password reuse or a password already exposed elsewhere.
- Weak account recovery, stolen sessions, or compromised email accounts.
- A service storing or handling your password insecurely.
Primary references
Our password and authentication guidance is cross-checked against primary sources when practical:
Next: read our editorial standards or use the password generator.