Guides
Password and Security Guides
How passwords are attacked, stored and protected - explained in plain language, with every technical claim linked to its primary source: NIST, OWASP, MDN, EFF and the IETF.
Attacks and password strength
How Passwords Get Cracked
Dictionary attacks, credential stuffing, spraying, online vs offline guessing, hashes and salts: how passwords are cracked and what actually stops it.
What Is a Brute-Force Attack?
A brute-force attack tries every possible password. Learn how search space, online limits, lockouts, MFA and slow hashes decide whether it can succeed.
What Is a Data Breach?
What a data breach is, how data gets exposed, how attackers use leaked passwords, and a calm step-by-step checklist for what to do if your data is exposed.
Strong Password Examples
Weak passwords people really use, what a strength estimator says about each, and the two patterns that hold up: random characters and random words.
Password Entropy Explained
What password entropy means, how the bits are calculated, why length matters, and why the formula only describes passwords that were randomly generated.
Secure randomness
CSPRNG vs Math.random(): Why Secure Password Generators Use Web Crypto
Why Math.random() is unsafe for passwords, how crypto.getRandomValues() works, and how rejection sampling removes modulo bias. With a tested example.
How Secure Random Number Generators Work
Entropy sources, seeds, DRBGs and the OS random generator: a plain-English look at how computers make unpredictable numbers for passwords and keys.
Why Our Password Generator Works Offline
Our password generator runs in your browser and keeps working offline. What that proves, what it does not, and how to check it yourself in two minutes.
Hashing and password storage
Hashing vs Encryption
Hashing is one-way; encryption is reversible with a key. How SHA-256, AES and password hashing differ, and which to use for files, data and logins.
How Passwords Should Be Stored
A developer guide to password storage: Argon2id, scrypt, bcrypt and PBKDF2 parameters, salts, peppers, NIST SP 800-63B rules, migrations and safe resets.
What Is a Cryptographic Salt?
A salt is a unique random value hashed with each password. Why salts exist, how they stop rainbow tables, where they are stored and what they can't do.
MD5 vs SHA-1 vs SHA-256
MD5, SHA-1 and SHA-256 compared: output size, history, collision status and file checksums - and why none of them should be used alone to store passwords.
Passphrases and sign-in
What Is a Passphrase?
A passphrase is a password made of random words. Learn how Diceware works, how many words you need, and which password ideas are strong or easy to guess.
What Is Two-Factor Authentication?
Two-factor authentication adds a second proof to your password. Compare security keys, passkeys, authenticator apps, push and SMS, and set up recovery.
Password Security Tips
Practical password tips based on NIST, CISA and FTC advice: long unique passwords, a password manager, 2FA, phishing checks and what to do after a breach.
Password Ideas
Good password ideas by situation: random words for the few you memorize, a manager for the rest. Plus popular ideas that fail, with estimator scores.
NIST Password Guidelines
What NIST SP 800-63B Rev. 4 says about passwords: 15-character minimum, no composition rules, no forced rotation, blocklists, and a policy checklist.
Password managers
Are Password Managers Safe?
How password managers encrypt your vault, what a breach would expose, the real risks, and how to set one up safely with a strong master password and MFA.
Best Password Managers
Eight password managers compared on encryption, free plan, price, MFA, passkeys, recovery, sharing and audits - from official vendor documentation.