Password generator
Create strong, random passwords in your browser. Choose the length and characters you need. Nothing is saved or sent anywhere.
chars in pool → log₂ = bits × 20 = bits
Offline crack time:
Pick at least one character type.
Crack times assume an attacker making 100 billion guesses per second against a stolen hash. How Entropy works
Passphrase generator
Make memorable passphrases from random common words. They're easier to type than random characters and just as hard to guess.
Offline crack time:
Words are drawn from a list of common English words. Each word adds about bits.
Without separators or capitals, words can run together (cat + alog reads as catalog), so the passphrase is slightly weaker than shown. Turn on Capitalize each word to keep the words distinct.
Dice passphrase generator
Roll real dice and turn the numbers into a passphrase, so no computer ever chooses it. Five dice pick one of 7,776 words from the EFF Diceware list.
Offline crack time:
- Roll five dice, or one die five times, and read the numbers left to right.
- Type them above. Spaces are optional: every five numbers pick one word.
- Repeat until you have at least 6 words for anything important, like a password manager's master password.
For a fully offline method, open the word list, print it, and look up your rolls on paper.
Word list by the Electronic Frontier Foundation, licensed CC BY 3.0 US. Your rolls never leave this page, and they're cleared after 5 minutes without activity, when you switch tools, or when you close the page.
PIN generator
Generate random PINs that skip the patterns people guess first, such as 1234, repeated digits, years and dates.
- entropy
- bits
- one guess
- — chance
- skipped
- easy PINs
Rules out repeats like 1111, runs like 3456, patterns like 1212, popular PINs, and anything that looks like a year or date.
Username generator
Get random username ideas for new accounts you'd rather keep separate from your real name.
Password strength checker
See how long a password would take to crack and whether it has appeared in a data breach. The password never leaves your device.
- entropy
- 0 bits
- crack time
- —
- breaches*
- not checked
* One exception, stated plainly: the breach check sends the first 5 characters of your password's SHA-1 hash, never the password itself, and compares the matches on your device. It searches Have I Been Pwned's list of over 900 million leaked passwords, and only runs when you press check breaches.
Strength is estimated with zxcvbn, which spots common words, names, dates and keyboard patterns. For your most important accounts, check a similar password rather than the real one. The box empties itself after 5 minutes, or when you switch to another tool.
Encrypted notes
Lock a message with a passphrase and send it safely. Only someone with the passphrase can unlock it, and nothing is stored anywhere.
Send this any way you like. Share the passphrase a different way, such as a phone call or another app, so nobody who sees one also gets the other.
Messages are locked with AES-256-GCM, using a key made from the passphrase with PBKDF2-SHA256 (600,000 rounds). Without the passphrase, a locked message can't be read, and any change to it is detected. The lock is only as strong as the passphrase, so use one with at least 4 random words. Everything here is cleared after 5 minutes without activity, when you switch tools, or when you close the page.
Link cleaner
Remove tracking codes like utm_source and fbclid from links, unwrap redirect links to see where they really go, and spot addresses pretending to be another site.
Paste one link, several, or a whole email or message. Everything is checked on your device; no link is opened or sent anywhere.
Your text with every link replaced by its cleaned version.
Short links such as bit.ly hide their destination, and finding it means contacting the short-link service, so Entropy only flags them. A clean-looking link can still lead to a harmful site.
2FA code generator
Show the two-factor login codes for a setup key or QR code, just like an authenticator app. The key stays on your device.
- new code in
- —
- next code
- —
Or paste a screenshot of the QR code anywhere on this tab.
The key is shown next to a site's 2FA QR code, usually behind "Can't scan it?". It never leaves this device, and it's cleared after 5 minutes without activity, when you switch tools, or when you close the page.
File hash checker
Get the SHA-256 and other hashes of a file or text, and check a download against the hash its publisher lists.
About Entropy
Free security tools that run entirely in your browser, with no accounts, cookies or tracking.
* One exception, stated plainly: the breach check sends the first 5 characters of your password's SHA-1 hash, never the password itself, and compares the matches on your device.
what it is
Entropy is a set of small security tools that run entirely in your browser. There are no accounts, no cookies and no analytics. What you generate or type is never saved or uploaded (the only thing kept is your light or dark choice, in this browser), and boxes that hold secrets empty themselves after 5 minutes without activity, when you switch tools, or when you close the page.
The name comes from how password strength is measured: entropy, in bits, counts how many guesses an attacker would need. Every extra bit doubles the work. Wherever it applies, each tool shows its working: the size of the pool, the bits per character or word, and the total.
the tools
- Password
- Random characters from the sets you choose, with at least one from each.
- Passphrase
- Random words from a list of common English words. Easier to remember and type than random characters.
- Dice passphrase
- Turns real dice rolls into words from the EFF Diceware list, for passphrases no computer chose.
- PIN
- Random digits that skip repeats, runs, popular PINs, years and dates.
- Username
- Random name ideas for accounts you'd rather keep separate.
- Check a password
- Estimates strength with zxcvbn, the checker built by Dropbox, and looks the password up in Have I Been Pwned's breach list.
- Encrypted notes
- Locks a message with a passphrase so you can send it safely. Only someone with the passphrase can read it.
- AI hidden text
- Shows what people can't see but AI can read: hidden instructions, invisible characters, direction tricks and lookalike letters, plus a cleaned copy.
- Link cleaner
- Removes tracking codes from links, unwraps redirect links, and warns about addresses that pretend to be another site.
- 2FA codes
- Shows the 6-digit codes for a setup key or QR code, using the same standard (RFC 6238) as authenticator apps.
- Hash
- SHA-1 and SHA-2 fingerprints of text or files, for checking downloads.
what leaves your device
Only these, and never anything you type:
| What | Sent to | When |
|---|---|---|
| Request for the fonts | Google Fonts | When the page loads |
| Request for the strength checker | cdnjs | When you open Check a password |
| Request for the QR reader | jsDelivr | When you scan a QR code |
| First 5 characters of the password's SHA-1 hash | Have I Been Pwned | When you press check breaches |
Fonts and code libraries come from this site itself, never from a third party.
The 5-character prefix is shared by hundreds of other passwords, so the service can't tell which one you checked. To confirm all this yourself, view the page source: everything is in one readable file.
use it offline
After your first visit, every tool except the breach check works without internet. Install Entropy to open it like an app.
On iPhone or iPad, tap Share, then Add to Home Screen.
Every random value comes from your browser's cryptographic generator (crypto.getRandomValues). Nothing you generate or type is saved or uploaded; About lists the few things the page does load. Crack times assume an attacker making 100 billion guesses per second against a stolen hash.