privacy
meets
cryptography
We are MyPassGen
Local tools in your browser: password generator, strength checker, and one-time secret links.
MyPassGen creates strong passwords, checks password strength, strips tracking parameters, shares self-destructing secrets, and encrypts files up to 5 GB. Computation uses the Web Crypto API on this device. Plaintext, keys, and files are not uploaded. No sign-up.
A look behind the curtain
Local at heart
Built for developers, operators, and anyone who shares a password
The same local-first rule applies when you rotate a password, check a weak passphrase, strip UTM from a campaign URL, or send a one-time secret.
- developers
- operators
- support teams
- founders
- security reviewers
- anyone sharing a secret
Things we do
Five privacy tools that stay in the browser you already have
Each page answers one job: generate a password, check strength, clean a URL, share a secret once, or encrypt a file. Nothing here asks you to register.
Framework
Secrets stay on your side of the glass. The browser does the math.
MyPassGen is a prism, not a vault. A password, a URL, a note, or a file stays on this device. Web Crypto runs AES-256-GCM in the tab. What comes out is a result you can check immediately — a strong password, a clean URL, a one-time link, or a locked file.
Selected tools
Five tools. One local-first rule.
You can verify the constraints yourself: AES-256-GCM, Web Crypto, a fragment key, and no registration wall.
01 Password
Random or readable
Default 16 characters. Below 8, we warn that the password is weak.
02 Strength
Entropy, not HIBP
Local scoring plus a built-in top leaked-password list. Not a live internet dump check.
03 Clean URL
Strip UTM, then redact
Remove tracking parameters and mask emails or API keys without leaving the tab.
04 One-time
Key lives after #
Ciphertext may be stored briefly. The key stays in the URL fragment and is never sent as a query.
05 Encrypt
Up to 5 GB, locally
Stream encrypt or decrypt in the browser. Output .lock or .enc. Passphrase never uploaded.
What you can hold us to
Answers you can hold us to before you paste a secret
Four facts, written the way the product actually behaves. No login wall. No silent upload.
No. The password generator, strength checker, UTM cleaner, text redaction, and file encryption all run in the browser. A one-time secret only stores ciphertext; the decryption key stays in the URL fragment after #.
No. Every tool opens and works without registration or a password vault.
No. Creating and reading both work without an account. The first successful read burns the note; opening it again shows that it has already been destroyed.
The password under test is not sent to an external API. We compute entropy locally and compare against a built-in public top leaked-password list. That catches common weak passwords. It is not a live HIBP lookup.
Technical choices
Facts you can check, not slogans you have to trust
These are the constraints the product is built on. Expand a row for the exact rule.
No alternate ciphers. Authenticated encryption for files and burn-link payloads.
Plaintext, keys, and files stay on the device by default. Nothing is uploaded for generation, strength checks, URL cleaning, or file encryption.
Fragments are not sent with the HTTP request. The server can hold ciphertext; it does not receive the key.
No registration for any tool. Recipients of a one-time secret also do not need an account.
Random mode defaults to 16 characters and warns below 8. File encryption writes .lock or .enc.
Ways to use it
Use one tool, or move through the whole set
Start with a strong password
Create a random password or a readable passphrase, copy it, and leave. Nothing is stored on our side.
Check how strong a password is
Paste a candidate into the local strength checker. You get entropy plus a check against a known leaked-password list.
Share a one-time secret
Encrypt a note, send the self-destructing link, and let the first read destroy it. The other person does not register.
Encrypt a file before it moves
Encrypt up to 5 GB in the tab you already have open. The passphrase never leaves the machine.
At a glance
3 key facts about MyPassGen
A small surface, held to a short list of rules. Remember these three and the rest of the site will read the same way.
No account, on purpose
There is no login, no user menu, and no password vault. Guest access is the product, not a trial mode.
The browser is the vault
Web Crypto runs AES-256-GCM on the device. You can inspect the network tab: generation, audit, cleaning, and file work do not upload plaintext.
One-time links split ciphertext from the key
Only ciphertext is stored. The key rides in the # fragment so it is not sent as part of the request.
MyPassGen