Sealed off · never uploaded · not even we can see them
Random passwords, passphrases, PINs and keys, from any of eight
standard random generators — or all of them combined. The generator
runs in a sealed-off part of this page that can't send anything
anywhere, and fresh passwords roll in on their own.
Saving it in a password manager? Random, 20 characters or more. You'll never type it, so make it as strong as the site allows.
Need to remember it? A passphrase of six words or more — your password manager's own master password, your computer login, disk encryption.
Reading it out or writing it down? Pronounceable, or Random with look-alikes switched off.
A phone, card or door keypad? A PIN. It's only safe because the device locks after a few wrong tries.
An API key, secret or salt for code? Key / token at 256 bits.
06Why no one can see them — not even us
Sealed off from the site
The generator runs in a sandboxed frame with no identity of its own. Nothing else on domainless.fun — the menu bar, sign-in, themes — can read it, and its security policy blocks every network request, so there is no way for a password to reach any server, ours included.
Never written down
The sandbox can't use cookies or storage, nothing goes in the address bar, and passwords are drawn as pictures rather than written into the page — so there's no text for your browser to autofill, spell-check, translate or restore later.
Wiped when you leave
Each batch comes from a freshly seeded generator that's erased the moment it's done. Leaving the page wipes the list, so Back can't bring it back, and Wipe now clears the page and your clipboard. Closing the tab ends it — we checked, in the browser's own memory.
Eight random generators, and what choosing one does.
Every generator here is a published standard, checked against its
official test vectors, and each is seeded from your device's own
cryptographic generator:
Cascade — all seven below, seeded separately, their output combined. The default.
Web Crypto — your operating system's generator, used directly.
ChaCha20 — the cipher behind Linux's /dev/urandom (RFC 8439).
AES-256 CTR_DRBG, HMAC_DRBG (SHA-256), Hash_DRBG (SHA-512) — the three NIST SP 800-90A generators.
SHAKE256 — from the SHA-3 standard, a completely different design (FIPS 202).
BLAKE2b — keyed BLAKE2b-512 (RFC 7693).
Combining generators means a flaw in any single one — even your
device's — can't make the result predictable on its own, and mixing in
your mouse, touch and typing rhythm adds randomness no generator could
know about. What it doesn't do is make a password longer: a
20-character password has the same number of possibilities whichever
generator picked it. Length is what makes a password strong.
Don't want to trust us? Keep your own copy. A website
can always change its code tomorrow. The offline copy is this same
generator in a single file that has no network access and never
updates — once it's saved, no one can change it, us included. Open it
straight from your computer, with the Wi-Fi off if you like.
To check the file you saved matches, run shasum -a 256 domainless-password-generator.html (Mac, Linux) or certutil -hashfile domainless-password-generator.html SHA256 (Windows).
What a web page can't wipe for you. A password you copy
goes to your system clipboard, which lives outside this tab. It's cleared
automatically after the delay you pick — browsers only allow that while
this tab is in front, so it waits for you to come back if you've switched
away. The clear replaces whatever is on your clipboard at that moment, and
clipboard-history tools (like Windows' Win+V) can keep their own copy.
Show as text puts the passwords back on the page as ordinary text,
which browsers can copy for their own features — Chrome does, at page
load — so leave it off unless you need a screen reader or want to select
one by hand. JavaScript can't overwrite memory, either; your browser frees
it when the tab closes. And any browser extension you've installed can
read any page, this one included.
About the strength figures. Bits measure how many
equally likely passwords the method could have produced, assuming an
attacker knows exactly which method and settings you picked. Each extra
bit doubles the work. The time shown is the average for an attacker making
a trillion guesses a second against a leaked, fast-hashed password list;
a website that limits login attempts is far slower to attack. Passphrases
use the EFF Large Wordlist
by the Electronic Frontier Foundation, licensed under
CC BY 3.0 US.
How the in-browser tools work →