PassGen — Secure Password Generator

PassGen makes strong passwords, passphrases and PINs on your own machine — and tells you exactly how strong they are. Most strength meters guess, scoring the characters of the finished password. PassGen does the opposite: it knows how the value was generated, so it reports the real number of bits and the exact size of the space it was drawn from. Change any option and the figure updates to match. THREE KINDS OF SECRET • Password — 4 to 128 characters from any mix of lowercase, uppercase, digits and symbols. Require at least one of each selected type, forbid repeated characters, drop ambiguous glyphs like 0/O and 1/l, stick to a "safe symbols" set for sites that reject exotic punctuation, or exclude specific characters a site won't take. • Passphrase — 2 to 12 words from the EFF diceware word lists (7776 or 1296 words), with your choice of separator, capitalization, optional digits and an optional symbol. Long, strong and actually retypable. • PIN — 3 to 16 digits, with obvious patterns like 0000, 1234 and 9876 excluded. BUILT TO BE CORRECT • Every random choice comes from the browser's cryptographic random source, never Math.random. • Rejection sampling everywhere it matters, so the output is uniform over exactly the space the entropy figure counts — no bias toward "balanced-looking" passwords. • Impossible settings are explained instead of silently ignored. • Time-to-crack shown for three attacker models: a rate-limited login, a slow password hash, and an offline GPU attack on a fast unsalted hash. QUICK TO USE • One click to copy, with an optional automatic clipboard wipe after a delay you choose. A wipe armed before you quit Chrome is finished when Chrome next starts. • Fill the password field on the page you're on, from the toolbar, a keyboard shortcut, or the right-click menu on any editable field. • Keyboard shortcuts: Alt+Shift+P to open, Alt+Shift+G to generate and copy, Alt+Shift+F to generate and fill. All rebindable. • A session-only history, so an accidental regenerate isn't a lost password. Never written to disk; disappears when Chrome closes. You can switch it off. • Light, dark and follow-the-system themes, and an option to keep the value masked until you reveal it. PRIVATE BY CONSTRUCTION PassGen has no server, no account, no analytics and no network requests of any kind — there is no fetch in the source, and its content security policy blocks remote code outright. It asks for no site permissions, so it has no standing access to any page: it can touch a page only in the tab where you just invoked it, only for that action. Nothing you generate is ever synced or written to disk by the extension. Free, open source (MIT), no dependencies and no build step — the code you can read is exactly the code that runs.