Valestiom

Security Tools

Create security-focused results without sending sensitive data away.

Browse security tools

Choose a focused tool and get the result directly in your browser.

Where the randomness comes from

A generated password is only as good as the randomness behind it. The generators here draw from the browser's cryptographic random number source rather than the ordinary pseudo-random function used for things like shuffling a list, because the ordinary one is predictable to anyone who can observe enough output.

That leaves the shape of the secret up to you, and there are two reasonable shapes. A random character string maximizes strength per character and belongs in a password manager, since nobody is memorizing it. A diceware-style passphrase strings together several random words, which is longer but can actually be typed from memory — the right choice for the handful of credentials you need without a manager, such as the manager's own master password or a disk encryption key.

Both are generated in the page and neither is stored or transmitted. Nothing to intercept, and nothing retained after you close the tab.

Generate a password Generate a passphrase

Strength score and entropy answer different questions

A strength score is a heuristic. It weighs length and character variety and flags recognizable patterns — keyboard runs, dates, a word with digits appended — which is how it catches passwords that look complicated to a rules checker but fall quickly to a real cracking dictionary.

Entropy is a measurement instead, expressed in bits, and it describes how large the search space is. Each additional bit doubles the work an attacker has to do, which is why the estimate is paired with cracking times for both online and offline attacks: the same password that would survive years of rate-limited login attempts can fall in hours against a stolen hash on dedicated hardware.

Use them together. The score tells you whether a password you already chose has an obvious weakness; the entropy figure tells you whether the scheme you are using is strong enough to be worth keeping.

Check password strength Calculate entropy

Verifying a file you downloaded

Projects that distribute installers and disk images usually publish a checksum next to the download. Computing the same hash locally and comparing the two confirms the file arrived intact and matches what the publisher released, which catches both a truncated download and a mirror serving something it should not.

Comparison is all-or-nothing: a single changed byte produces a completely different hash, so either the strings match exactly or the file is not the one that was published. Checking the first and last few characters is a reasonable shortcut in practice.

Hashing here reads the file in the browser, so verifying a large image does not mean uploading it anywhere first. Address checking works the same way — validating a list of email addresses gives a specific reason for each rejection without any of those addresses leaving the device. Both habits, check locally and send nothing, hold across the site, and the directory shows what else is available without a signup step in front of it.

Check a file hash Validate email addresses See all tools

Explore other categories

Find more private tools for files, text, development, and everyday work.