Local generation
Passwords are generated entirely in your browser with the Web Crypto API — nothing leaves your device for that. Hashing runs on our own server over HTTPS: never stored, never logged, no third party involved.
Strong passwords, generated locally.
Generated locally. Never stored. Never logged.
0 bits —
Password hashing
Hash your password with Argon2id or bcrypt. Hashing is a one-way process: the output cannot be turned back into the original password. It is not encryption — there is no key and no way to “decrypt” a hash.
Generation happens entirely in your browser. Hashing is performed by the accessbg.eu server over HTTPS — the password is never stored and request bodies are never logged.
Why this is secure
True randomness
Every character comes from crypto.getRandomValues() with
rejection sampling, so there is no modulo bias. Math.random()
is never used.
Modern hashing
Argon2id — winner of the Password Hashing Competition — resists GPU and ASIC attacks through memory hardness. bcrypt remains a solid, widely supported alternative.
No tracking
No analytics, no cookies, no third-party requests, no CDNs. Fonts and assets are served by the same origin you are already visiting.
FAQ
What is entropy?
Entropy measures unpredictability in bits. Each extra bit doubles the number of guesses an attacker needs. A 20-character password using all character sets has roughly 128 bits of entropy — far beyond brute-force reach.
Argon2id or bcrypt — which should I use?
Prefer Argon2id: it is memory-hard, which makes parallel GPU attacks expensive. Use bcrypt when integrating with older systems that already support it. Remember that bcrypt ignores input past 72 bytes.
Why is hashing not encryption?
Encryption is reversible with a key; hashing is a one-way function. A server stores your hash and re-hashes what you type to compare — it never needs to know your actual password, and a database leak does not reveal it directly.
Does my password ever leave my device?
For generation, no — it is created locally and never sent anywhere. For hashing, the password is sent over HTTPS to the accessbg.eu server, which computes the hash and immediately discards it. It is never stored and request bodies are never logged.