Core principle: local-first by default
Most CreatePassword tools are designed so that the sensitive work happens on your device. When you generate a password, passphrase, UUID, API key, or hash, the computation runs in your browser using JavaScript and the Web Crypto API. No network request is made to create the output, and the result is not uploaded to createpassword.in for storage. You can verify this yourself: open your browser DevTools, switch to the Network tab, and use a generator — you will see no outbound call tied to generation.
Randomness source
The password, passphrase, UUID, and API key generators draw randomness from crypto.getRandomValues(), a cryptographically secure pseudo-random number generator (CSPRNG) provided by the browser. This is the appropriate primitive for security-sensitive generation and is the same family of APIs browsers rely on for their own security operations. We do not use Math.random() for any secret output.
No outbound request
Password, passphrase, UUID, API key, hash, and QR tools make no network call to produce output.
CSPRNG randomness
Secrets come from crypto.getRandomValues(), not Math.random().
No server-side vault
We do not operate a cloud database of credentials you generate. What you create stays under your control.
No account needed
Core tools have no signup, no email capture, and no login wall.
Password Breach Checker: k-anonymity model
The Password Breach Checker is the only tool that makes an outbound network request, and it is built to reveal the minimum possible. The workflow:
- You enter a password in the field (shown or hidden at your choice).
- Your browser computes a SHA-1 hash of that password locally with the Web Crypto API.
- Only the first five hexadecimal characters of that hash are sent to
api.pwnedpasswords.com/range/…. - The service returns many hash suffixes and occurrence counts for that prefix. Your browser compares the rest of your hash locally.
- You see either a match count or “not found.” The plaintext password is never in the request URL or body.
This is the k-anonymity model documented by Have I Been Pwned: the service never receives enough of the hash to reverse a unique password from the query alone. We do not log full hashes or plaintext passwords on our servers, and we do not implement HIBP email/account breach lookup (that API differs and typically requires an API key). See the official HIBP Pwned Passwords documentation for the authoritative description.
Strength checker: a heuristic, not a prediction
The password strength checker scores length and character-class variety and flags a few common weak patterns. It is a teaching aid, not a lab-grade crack-time oracle. We deliberately do not promise a specific crack time, because real crack time depends on attacker resources, the hashing algorithm a site uses, and whether the password was reused or leaked — none of which a local heuristic can know. Following NIST SP 800-63 principles, we encourage length and uniqueness over checkbox complexity, and we recommend pairing the checker with a breach check.
Hash generator
The hash generator computes MD5, SHA-1, SHA-256, and SHA-512 digests of text you enter, entirely in your browser. The input is not uploaded. We document on the tool page that MD5 and SHA-1 are not suitable for password storage — they appear here for checksum and legacy-compatibility use cases. Modern password storage should use slow, salted KDFs such as Argon2, bcrypt, or PBKDF2, as described in the OWASP Password Storage Cheat Sheet.
What we do not claim
- We do not call any password “uncrackable,” “guaranteed secure,” or “impossible to crack.” No password is.
- We do not guarantee specific crack times or cite invented statistics.
- We do not claim compliance certifications, audits, or partnerships we do not have.
- We do not claim the breach checker protects email addresses with k-anonymity — it screens passwords only.
- We do not claim uppercase + lowercase + number + symbol automatically equals a strong password. Those are customization options, not the definition of strength.
Analytics and advertising
Like many free websites, some pages may load standard web analytics or advertising scripts. These scripts are not used to collect the passwords you type into generators, and generated secrets are never sent to our servers. For full detail see our privacy policy. If you need maximum session isolation, a private browsing window works well with all of the local tools.
Responsible disclosure
If you believe you have found a security issue with CreatePassword, please report it through the contact page with a clear description and reproduction steps. Do not include any real password or sensitive credential in your message. We aim to acknowledge credible reports promptly.
Frequently asked questions
Does CreatePassword store the passwords I generate?
No. The password, passphrase, UUID, API key, hash, and QR tools run in your browser and make no outbound request to createpassword.in to store output. Generated secrets exist only on your screen unless you copy them elsewhere.
What does the breach checker send over the network?
Only the first five hexadecimal characters of a locally computed SHA-1 hash, sent to the Have I Been Pwned Pwned Passwords range API. The plaintext password and the full hash never leave your browser.
Is “not found” in the breach checker a guarantee of safety?
No. It means the password did not appear in the queried Pwned Passwords corpus. It does not prove strength, uniqueness, or that the password was never exposed in an unpublished breach. Always prefer long, unique credentials and MFA.
Why does the strength checker not guarantee a crack time?
Crack time depends on attacker resources, hashing cost, and whether the password was reused or leaked — none of which a local heuristic can know. The checker scores length and character variety as a teaching aid, not a prediction.
Which cryptographic standard does the generator use?
The browser Web Crypto API, specifically crypto.getRandomValues(), which provides cryptographically secure random numbers. This is the same family of primitives used for security-sensitive browser operations.
Does CreatePassword follow NIST guidance?
Our guidance aligns with NIST SP 800-63 principles: long unique passphrases, password managers, screening against compromised passwords, MFA, and no arbitrary periodic resets. We link to the authoritative source rather than restating it as our own.