// online security
A password, PIN, and passphrase generator that runs entirely in your browser — plus the security habits worth building early in a tech career.
Everything is generated locally in your browser using the Web Crypto API (crypto.getRandomValues), the same cryptographically secure source used for real security work. Nothing you generate is sent over the network, logged, or stored — this page has no server component at all. Reload it and the value is gone.
“Bits of entropy” measures how many guesses an attacker would need on average. Each additional bit doubles that number, which is why length matters far more than swapping an a for a 4.
// good habits
A manager is what makes unique passwords per site realistic. Generate a long random password for every account and let the manager remember it — you only memorize one strong passphrase.
A stolen password alone should not be enough to get in. Prefer an authenticator app or hardware key over SMS, which can be intercepted through SIM swapping.
When one site is breached, attackers replay that email and password across every other service. This is called credential stuffing, and it is how most account takeovers actually happen.
Phishing is still the most common way accounts are compromised. Check the sending domain carefully and navigate to sites directly rather than clicking through an email.
API keys and passwords do not belong in a repository — use environment variables. Git history remembers a committed secret even after you delete it, so it must be rotated.
Services like Have I Been Pwned tell you if your email has appeared in a known data breach. If it has, change that password everywhere you reused it.