MaskNet Tools
Generate a strong password
Set the length and the character set. The password is generated directly in your browser and is never sent to the server.
Already have a password?
How to create a strong password
How to use the generator
- Pick the length. The slider goes from 12 to 64 characters. For email, banking and messengers, use 16 or more.
- Choose the character sets. Upper- and lowercase letters, digits, special characters. The more sets, the more options for every character.
- Exclude look-alike characters if you will type or dictate the password:
l,1andI,Oand0won't get mixed up. - Copy the password and save it in a password manager right away. The refresh button creates a new one.
Why the password is random and goes nowhere
The password is created in your browser. Characters are picked by the browser's built-in cryptographic random number generator — the same one used for encryption keys. The choice is uniform: no letter or digit comes up more often than others.
The password is never sent to the MaskNet server and isn't stored anywhere. Close the page and it exists only where you copied it.
What the strength rating means
Strength is measured in entropy — how many bits of uncertainty the password has. It grows with length and with the number of character sets. Under 55 bits is weak, 55 to 80 is medium, 80 to 110 is strong, over 110 is very strong.
Length matters more than complexity. 16 random letters and digits are stronger than 10 characters with every special symbol.
Checking a password you already use
The "Breach check" tab shows whether a password has appeared in known data breaches. Your browser computes the password's SHA-1 hash and sends only the first five characters of the hash to the Have I Been Pwned database. The database returns every hash with that prefix, and the browser looks for a match itself. Neither the password nor its full hash leaves your device.
Never use a breached password, even if it looks complex: such passwords are the first ones tried in attacks.
Rules that matter more than any generator
- One password per site. A leak on one site shouldn't unlock the rest.
- Keep passwords in a password manager, not in notes or in a browser without a master password.
- Turn on sign-in confirmation — an app code or a passkey — wherever it is available.
- On public Wi-Fi, type passwords only on HTTPS sites. Why open networks are risky — in How safe is public Wi-Fi.
Frequently asked questions
How long should a password be?+
At least 12 characters, and 16 or more for important accounts. The generator starts at 12 and goes up to 64.
Is it safe to generate a password online?+
Here, yes: the password is created in your browser by its built-in cryptographic generator and is never sent to a server. It works even offline once the page is open.
Do I need special characters?+
They add options per character, but length matters more. If a site doesn't accept special characters, make the password longer — strength won't suffer.
How do I check whether my password has leaked?+
Use the "Breach check" tab: only the first five characters of the password's hash go to the breach database, and the password stays in your browser.