About PassForge

A fast, private, client-side password generator with no strings attached.

Security model reviewed August 27, 2026

How it works

Every password PassForge generates runs entirely inside your browser — no data is ever sent to a server. The generator uses the Web Crypto API:

crypto.getRandomValues(new Uint32Array(length))

This API is built into every modern browser and provides cryptographically secure random numbers seeded by the operating system — the same source of randomness used by security software and password managers.

Privacy by design

PassForge has no backend. There is no database, no user accounts, and no API that receives your passwords. The page loads once, and after that everything happens locally in JavaScript.

We use Google Analytics to measure aggregate traffic (page views, not password contents). No personally identifiable information is collected, and we never log any generated passwords.

Why client-side generation matters

Many password generator websites secretly log the passwords they generate — or could, if their server were compromised. Client-side generation eliminates this attack surface entirely:

No server-side logging — Your password is never transmitted, so it cannot be intercepted or stored.

Smaller network exposure — Generated values are not intentionally submitted to our server. A compromised page, browser, device, or third-party script would still be a risk.

Auditable — The source code is straightforward JavaScript you can read in DevTools.

Understanding password strength

PassForge measures strength in entropy bits. Entropy is calculated as:

bits = log₂(pool_size ^ length)

Each additional bit doubles the number of guesses required to brute-force the password. A 16-character password with all character sets enabled achieves approximately 100 bits of entropy — more combinations than atoms in the observable universe.

Strength	Entropy	Verdict
Weak	< 40 bits	Avoid
Fair	40–59 bits	Low-value accounts only
Strong	60–79 bits	Good for most uses
Very Strong	80+ bits	Excellent

Security references and limits

W3C Web Cryptography API documents the getRandomValues() primitive used by the generator.

NIST SP 800-63B is the primary reference for current password guidance, including length, blocklists, password managers, and verifier behavior.

CISA Secure Our World recommends strong, unique passwords and a password manager.

Client-side generation does not make a compromised browser, extension, device, page delivery path, or third-party script safe. For high-value credentials, use a reputable password manager's built-in generator and enable phishing-resistant MFA where available.

The implementation claims, source links, and threat-model language on this page were reviewed August 27, 2026.

Generate a password