People still reuse the dog's name plus a 1. PassShift generates passwords and passphrases in the browser with Web Crypto, so the entropy comes from the platform CSPRNG and never from a server log. Use it when you are creating a new secret for a manager, a Wi-Fi QR, or a PDF open password. Do not use it as a password manager, a sync vault, or a promise that a 12-character password is enough for every threat. Length and uniqueness beat clever substitutions. The hygiene guide on the site is the sermon; this page is the generator.
Password mode: length, classes (upper, lower, digit, symbol). Passphrase mode: random words with a separator, easier to type, still fine if the word list and count are honest. Copy once into a manager. Reloading the page should produce a new secret; do not screenshot a grid of passwords into chat. If the generator looks 'stuck' on the same string, you copied it twice, not the RNG breaking.
When not to use PassShift: recovering an existing password, deriving a key from a memorable sentence you made up (that is not Web Crypto random), or generating a PIN that a site will then truncate to 4 digits. Also skip it if you were about to email the result to yourself. The secret's life starts in the manager, not in Gmail.
Web Crypto is the privacy story. Nothing to store, nothing to leak from our side. Your clipboard, your screenshots, your shoulder, still leak. Clear the clipboard if you paste through a manager that does not. For PDF and Wi-Fi, generate here, then paste into PdfProtectShift or QRShift on the same machine.
You need an open password for a tax PDF. PassShift, 20 characters, all classes, one generate. You store it in the manager under 'accountant 2025 pdf,' paste into PdfProtectShift, never into the email body. A passphrase example for a Wi-Fi guest network: five random words, enough to type on a phone, rotated when the intern leaves. Neither string was logged on a generator website. Twenty random characters in a manager under a boring name is how a tax PDF password should live.
PassShift uses Web Crypto in the browser. Generated secrets are not uploaded and not stored on a server. Clipboard, screenshots, and shoulder surfing are still on you. Close the tab after the secret lives in a manager. Clipboard, screenshots, and shoulders still leak; the generator itself has nothing to log.
Full policy: Shift Privacy Policy. Questions: [email protected].
Passwords for fields that hate spaces. Passphrases for humans who have to type on a TV or a friend. Both must be random. A quote from a movie is not a passphrase.
For a unique random password in a manager, it can be. Unique matters more than a punctuation ritual. The hygiene guide is more useful than a single number on this page.
Math.random is not a CSPRNG. Web Crypto is what browsers give you for secrets. A generator that uses the wrong RNG is a blog post, not a tool. Math.random is not a CSPRNG; Web Crypto is what browsers give you for secrets on purpose.
No, and if a site offers to, run. Copy into a manager. Our generator has nothing to email because it never received the string. A site that offers to email the password is a site to leave; we have nothing to email because we never stored it.
Longer guide: Password Hygiene
Related tools: HashShift · QRShift · PdfProtectShift
Guides · All Shift tools · About · Contact