Question 1

Are my passwords stored or sent to a server?

Accepted Answer

Never. All tools on PasswordGenerator.one run entirely in your browser using the Web Crypto API. No passwords, passphrases, or analyzed text ever leaves your device. You can verify this by disconnecting from the internet and using the tools offline.

Question 2

What is the Web Crypto API?

Accepted Answer

The Web Crypto API is a browser-native interface for cryptographic operations. It provides access to a cryptographically strong random number generator (crypto.getRandomValues()) that produces true randomness suitable for security applications. It is built into all modern browsers and requires no plugins or downloads.

Question 3

How long should my password be?

Accepted Answer

For general accounts, use at least 12 characters. For important accounts (email, banking, cloud storage), use 16 or more characters. Each additional character exponentially increases the number of possible combinations. With all character types enabled, a 16-character password has over 80 bits of entropy.

Question 4

What is password entropy?

Accepted Answer

Entropy measures the unpredictability of a password in bits. It is calculated as: Length x log2(Character Set Size). Higher entropy means more possible combinations and longer crack times. Aim for 80+ bits for important accounts.

Question 5

Is a passphrase more secure than a password?

Accepted Answer

A well-generated passphrase of 5+ random words provides comparable or better security than a 16-character random password. The key advantage is memorability — you can remember 'Marble-Sunset-Bicycle-Ocean-Thunder' much more easily than 'X7#mK9$pL2vN4@qR'. Both are secure when generated randomly.

Question 6

How is crack time calculated?

Accepted Answer

We assume an attacker can make 10 billion guesses per second, which is realistic for a well-funded attacker using GPU clusters. The crack time is calculated as 2^entropy / guesses_per_second. This represents the average time for a brute-force attack against the full key space.

Question 7

Why does the strength checker penalize common patterns?

Accepted Answer

Real-world attackers do not use pure brute force. They use dictionaries, common password lists, keyboard pattern databases, and leet-speak substitution rules. A password like 'P@$$w0rd123!' looks complex but is trivially crackable because it follows predictable patterns. Our checker accounts for these real-world attack strategies.

Question 8

Should I use a password manager?

Accepted Answer

Absolutely. A password manager is the only practical way to use strong, unique passwords for every account. We recommend Bitwarden (free, open-source) or 1Password (premium). Read our Password Manager Guide for detailed setup instructions.

Question 9

What is two-factor authentication (2FA)?

Accepted Answer

2FA adds a second verification step beyond your password, typically a code from an authenticator app or a hardware security key. Even if someone steals your password, they cannot access your account without the second factor. We recommend enabling 2FA on all important accounts.

Question 10

Is PasswordGenerator.one really free?

Accepted Answer

Yes, all tools are completely free with no account required and no usage limits. We sustain the site through non-intrusive advertising. We will never charge for our core password tools.

Question 11

Can I use these tools on my phone?

Accepted Answer

Yes. All tools are fully responsive and work on any device with a modern browser — smartphones, tablets, laptops, and desktops. No app download is needed.

Question 12

Do you support dark mode?

Accepted Answer

Yes. PasswordGenerator.one supports both light and dark modes. It automatically matches your system preference, and you can toggle between modes using the theme switch in the header.

Frequently Asked Questions