Password generator
Strong random passwords – free, without tracking, cookies or third-party scripts.
Choose the settings and click Generate password. The password is created only at that moment, for you alone, and is stored nowhere.
Why Klarpass and not just any online generator?
Most password generators on the web run as JavaScript in your browser – on a page that often also loads a tag manager, analytics, advertising or A/B-testing scripts from third parties. Every one of those scripts can read the password in the page. We chose the other path, and we lay open what that means:
| Klarpass | Typical in-browser generator | |
|---|---|---|
| Randomness | The kernel's cryptographic random number generator (Linux getrandom), used directly | The browser's random source, sometimes run through an outdated extra generator (such as RC4), with Math.random as a silent fallback |
| Even distribution | Exact: rejection sampling, every character equally likely | Often a plain modulo, which favours some characters slightly |
| Scripts on the page | Only our own few lines for the Copy button, pinned to exactly that code by the Content Security Policy and without network access; third-party scripts are ruled out technically | Often tag manager, tracking and testing scripts from third parties |
| Cookies and tracking | None, so no consent banner | Common, with a consent banner |
| Default strength | 20 characters from 94, about 130 bits – above the 128-bit level of AES-128 | Depends on the settings |
| Where the password exists | Only for one request on our hardened server: drawn in locked, guarded memory, and our service wipes its copies after sending; sent over HTTPS | In your browser, next to every script the page loads |
Check it yourself: open the developer tools (F12), tab Network, and reload. This page makes exactly one request – itself. No script file, no font, no tracker.
Why Klarpass is safe
- Real randomness. Every character comes from the operating system's cryptographic random number generator, drawn uniformly (rejection sampling, no modulo bias).
- Nothing is stored. No account, no database, no access logs, no cookies. Every response carries
Cache-Control: no-store. - No third-party code. A strict Content Security Policy allows this one page only: no external scripts, no trackers, no CDNs, no external fonts. The only script is our own Copy button; the page works without it.
- A hardened server. The service runs sandboxed under its own user, its memory cannot be dumped or attached to by a debugger, and the password is built in locked, guarded memory that is wiped after the request.
- The honest limit. The password is created on our server, so it exists there in memory for the duration of one request. It travels encrypted (HTTPS) and is stored nowhere. For accounts with the highest protection needs, generate the password directly in your password manager.
Using passwords well
- At least 16 characters for important accounts, 20 or more for e-mail and online banking.
- A separate password for every account – a password manager remembers them for you.
- Turn on two-factor sign-in wherever it is offered.
- Never send a password by e-mail or chat.
Frequently asked questions
- How strong is a 20-character password?
- With all four character types it has about 130 bits of entropy. Even at a trillion guesses per second, trying them all would take far longer than the age of the universe.
- Why is there no password before I click?
- So that you can be sure: nobody has seen your password before. It is drawn only when you click – no cache, no search engine and no other visitor ever got the same page.
- Does Klarpass store my passwords?
- No. The password is generated for your request, sent to you and then wiped from memory. There is no database and no log that could hold it.
- Why almost no JavaScript?
- Every script is attack surface and a way to load third-party code. The only script here is our own Copy button: a few lines, pinned by its hash in the Content Security Policy, without network access. Generating works without any JavaScript.
- Who is behind Klarpass?
- Frederich Engineering from Kirchheim unter Teck, Germany. We build security software you can check – for example Klarfeed, an RSS reader without tracking.