About

About PassZen

PassZen is a free, browser-based password and PIN generator. It was built as a small, transparent tool: open the page, get a strong random secret in one click, and understand exactly how it was produced, without creating an account or handing over an email address.

In a landscape of generators buried inside ad-heavy pages, sign-up walls, and “free” apps that quietly upload every secret they create, we wanted the opposite: a page you can read in a minute, verify with your browser's network tab, and trust because the design gives you no reason not to. This page explains what the tool does, the principles behind it, what it deliberately refuses to do, how the site pays for itself, and how to use it across your devices.

Modes: Password & PIN
Random source: Web Crypto API
Price: Free

What the tool does

The generator creates random passwords and numeric PINs using your browser's built-in cryptographic random number generator, crypto.getRandomValues(). Random characters are drawn from the sets you enable, uppercase, lowercase, digits, and symbols, with rejection sampling so every character in the alphabet is equally likely. A strength meter then shows an entropy estimate in bits, calculated from the alphabet size and the length of the result, so you can see what makes one password stronger than another.

Everything happens in the page on your device. The generation code does not make network requests, and generated secrets are not written to cookies, URLs, or analytics events. Generated secrets stay in the tab's memory only and disappear when you close it.

Two modes cover the common cases. Password mode mixes letters, digits, and symbols into strings from 8 to 64 characters, long enough for the strictest corporate policies, short enough for quick logins. PIN mode produces random digit codes from 4 to 12 digits for phone locks, door keypads, safes, and similar devices. A live strength meter updates as you change length or character sets, so you can watch the entropy number climb in real time instead of guessing whether “P@ssw0rd1” is good enough (it is not).

Under the hood, the math is standard and auditable: entropy equals the length of the secret times the base-2 logarithm of the alphabet size. There are no hidden heuristics, no “security through obscurity” tricks, and no server-side salt, because there is no server side. What you see in the meter is what information theory says about the string on screen.

How the randomness works

Secure randomness is the foundation of the whole tool, so it deserves a plain explanation. JavaScript's Math.random() is fast but predictable: many implementations are seedable and reversible, which is fine for shuffling a playlist and unacceptable for a password. The Web Crypto API's crypto.getRandomValues() draws from your operating system's entropy pool, the same source used for TLS handshakes and session tokens, and is designed so that observing past outputs does not reveal future ones.

Mapping those random bytes onto your chosen alphabet introduces one classic pitfall: modulo bias, where a naive % alphabet.length makes some characters slightly more likely than others. We avoid it with rejection sampling, bytes that would skew the distribution are discarded and redrawn, so every enabled character has exactly the same probability. It costs a few extra random bytes and buys you a mathematically uniform secret.

Why we built it

Most people reuse passwords because inventing unique ones is tedious, and most generators make the problem worse: they bury the button under pop-ups, push weak defaults, or run on servers that could (theoretically) log every secret they mint. Breach after breach has shown that reuse is the single biggest multiplier of account takeovers, yet the fix remains embarrassingly simple: give every account its own long, random password.

PassZen exists to make that fix frictionless. One click yields a 20-character default with all character types enabled; the entropy readout teaches while it reassures; and the client-side architecture removes the trust question entirely. You do not have to believe our marketing copy, open the network tab and watch the requests (there are none that carry your password). The tool is aimed at the moment you set up a password manager, rotate a compromised credential, or need a keypad code: short, intentional visits where speed and trust both matter.

Our principles

Generated secrets stay on your device. There are no accounts and no server-side storage of passwords, the architecture simply keeps generation client-side.
Show real numbers. The strength meter reports an entropy estimate based on the same math used in information theory, instead of an unlabeled score.
Consent-first for optional scripts. Analytics and advertising, if ever enabled, are opt-in: nothing in those categories loads until you accept it, and Do Not Track / Global Privacy Control signals turn them off automatically.
Works for as many people as possible. The interface is keyboard-navigable, announces the generated output to screen readers, respects reduced-motion settings, and adapts from small phones to desktop screens. The site is also installable as a progressive web app (PWA) and loads offline once cached.
Defaults you would actually want. The out-of-the-box settings (20 characters, uppercase, lowercase, digits, symbols) already land in “strong” territory. You can loosen them for a keypad code, but you never have to fight the tool to get a secure result.
Plain language over jargon. The UI says “Strong”, shows the bits behind it, and links to an explanation. We would rather you understand entropy than blindly trust a green bar.

What we do not do

We do not require accounts, emails, or payment details.
We do not transmit generated passwords or PINs to a server.
We do not include password values in analytics events; events record only actions such as “a password was generated”.
We do not store your history. Generated secrets live in the tab's memory and vanish on close; close the tab and there is nothing left to subpoena, sell, or leak.
We do not fingerprint your device for advertising. Optional ad tags, when enabled, load only after marketing consent and are isolated from the generator's code.
We do not promise that any specific secret is uncrackable, no one honestly can. See the terms.

Who it is for

PassZen suits anyone who needs a strong secret without ceremony: people setting up a password manager for the first time, administrators rotating credentials after a breach notice, developers minting throwaway tokens, parents creating Wi-Fi or safe combinations, or privacy-conscious users who simply do not want a generator phoning home. It works the same whether you visit once a year or every week, there is no profile to maintain and no history to manage.

It is equally useful as a teaching tool. Because the entropy estimate updates live, you can demonstrate to a colleague or classroom why 12 characters beat 8, why symbols matter less than length, and why a 6-digit PIN has no business guarding a bank login. The numbers on screen come from the same formulas used in security textbooks, which makes the lesson concrete rather than abstract.

Using PassZen on your devices

The layout is responsive and works on phones, tablets, laptops, and large desktop screens. On Android and desktop Chrome/Edge you can install it from the browser's “Install app” menu (and on iOS via Share → Add to Home Screen); the installed version opens in its own window, and because the generator runs locally, previously visited pages keep working without a connection. You can also read the password security guide on the homepage for practical advice on length, entropy, and 2FA.

Keyboard users can press R to regenerate, tab through every control, and copy the result with the copy button or a standard copy shortcut. Screen readers announce the generated value and the current strength label. Because the page uses only system fonts and minimal JavaScript, it loads quickly on slow connections and battery-friendly on mobile, useful when you need a one-off secret while traveling.

How the site is funded

PassZen is free to use for personal and commercial purposes. To cover hosting and development costs, the site may show clearly labelled advertising banners. Advertising cookies and tags are gated behind your marketing consent, if you decline, the ad areas simply stay empty. Generation code and advertising code are separate, and ads never receive your secrets. See our Privacy Policy and Terms for details.

We do not sell premium tiers, we do not upsell “military-grade” add-ons, and we do not monetize your attention with interstitials. If ad revenue ever stops covering costs, the honest options are soliciting donations or finding a sponsor whose values match the site's, not locking the generator behind a paywall or quietly harvesting data. Any material change to the funding model will be stated here and in the privacy policy before it takes effect.

Questions, bug reports, or feedback?

Accessibility notes, security disclosures, and feature requests are welcome on the contact page, or by email at [email protected]. Please never include a real password in your message, steps to reproduce and screenshots are enough.

About PassZen: common questions

Who built this and why?

PassZen was started by a small group of developers who were tired of generators that required sign-ups, injected trackers before the first click, or used predictable Math.random(). The goal is a single page that does one job well: produce a strong secret locally, show the real entropy number, and get out of your way.

Is the source code open?

The generator's logic (character-set assembly, rejection sampling, entropy math) is deliberately small and readable. You can inspect every network request from your browser's developer tools, or load the page while offline and watch generation keep working. If you find a discrepancy between what we describe and what the page does, please report it.

Do you sell or share data?

No. We do not sell personal information, we do not share it for cross-context behavioral advertising, and generated passwords never leave your device. Optional analytics and advertising (both off by default) load only after explicit consent, and even then they receive anonymous events; never secret values. See the Privacy Policy for the full picture.

How can I verify passwords never leave my browser?

Open developer tools (F12), switch to the Network tab, generate a password, and confirm no request carries the result. Alternatively, load the page, disconnect from the internet, and generate again, it still works, because everything runs locally. Advanced users can also view the page source and read the generation code directly.

What browsers are supported?

Any modern browser with the Web Crypto API, current versions of Chrome, Edge, Firefox, and Safari on desktop and mobile. Because we use system fonts and plain HTML/CSS/JS, even lightweight browsers work. Very old browsers without crypto.getRandomValues() are not supported: a generator that falls back to a weak random source would be worse than no generator at all.

Do you take feature requests?

Yes. Email the address on the contact page with your use case, not just the feature, but what you are trying to accomplish. Popular requests so far have included longer PIN modes, passphrase word-lists, and export formats for password managers. We weigh requests against complexity and privacy impact: anything that would require transmitting secrets is off the table by design.