privacy
meets
cryptography
We are MyPassGen
A browser-local encryption and privacy toolkit that turns everyday secrets into results you can verify on the spot.
Generate passwords, audit strength, clean tracking links, share burn-after-read notes, and encrypt files up to 5 GB. Computation stays in your browser through the Web Crypto API. Plaintext, keys, and files are not uploaded. Every tool opens without an account.
A look behind the curtain
Local at heart
Built for people who handle secrets across future-facing work
The same local-first rules apply whether you are rotating credentials, cleaning a campaign URL, or handing someone a one-time secret.
- developers
- operators
- support teams
- founders
- security reviewers
- anyone sharing a secret
Things we do
The most sensitive tasks need tools that never leave the machine
Five focused utilities. Each one answers a single search intent and runs in the browser you already have.
Framework
Combining a spectrum of secrets, constraints, and people
MyPassGen acts as a prism. Inputs stay on your side of the glass. The browser refracts them through Web Crypto. What comes out is a result you can check immediately — a password, a cleaned URL, a burn link, or a locked file.
Selected tools
Five utilities. One local-first roof.
The work speaks in constraints you can verify: algorithm, location, fragment keys, and an open door.
01 Generator
Random or readable
Default 16 characters. Below 8, we warn that the password is weak.
02 Audit
Entropy, not HIBP
Local scoring plus a built-in top leaked-password list. Not a live internet dump check.
03 Privacy
Clean, then redact
Strip trackers from links and mask sensitive text without leaving the tab.
04 Burn link
Key lives after #
Ciphertext may be stored briefly. The key stays in the URL fragment and is never sent as a query.
05 File box
Up to 5 GB, locally
Stream encrypt or decrypt in the browser. Output .lock or .enc. Passphrase never uploaded.
What you can hold us to
Trusted for work that should never become someone else's log line
Four facts, written the way the product actually behaves. No login wall. No silent upload.
No. Password generation, strength audit, link cleaning, text redaction, and file encryption all run in the browser. Burn-after-read only stores ciphertext; the decryption key stays in the client URL fragment after #.
No. Every tool opens and works without registration.
No. Creating and reading both work without an account. The first successful read burns the note; opening it again shows that it has already been destroyed.
The password under test is not sent to an external API. We compute entropy locally and compare against a built-in public top leaked-password list. That catches common weak passwords. It is not a full-internet HIBP lookup.
Technical choices
Facts you can check, not slogans you have to trust
These are the constraints the product is built on. Expand a row for the exact rule.
No alternate ciphers. Authenticated encryption for files and burn-link payloads.
Plaintext, keys, and files stay on the device by default. Nothing is uploaded for generation, audit, cleaning, or file-box work.
Fragments are not sent with the HTTP request. The server can hold ciphertext; it does not receive the key.
No registration for any tool. Recipients of a burn-link reading page also do not need an account.
Random mode defaults to 16 characters and warns below 8. File box writes .lock or .enc.
Ways to use it
Use one tool, or move through the whole set
Start with a password
Create a random string or a readable passphrase, copy it, and leave. Nothing is stored on our side.
Check what you already have
Paste a candidate into the local audit. You get entropy plus a check against a known weak-password list.
Share once, then disappear
Encrypt a note, send the link, and let the first read destroy it. The other person does not register.
Lock a file before it moves
Encrypt up to 5 GB in the tab you already have open. The passphrase never leaves the machine.
At a glance
3 key facts about MyPassGen
A small surface, held to a short list of rules. Remember these three and the rest of the site will read the same way.
No account, on purpose
There is no login, no user menu, and no password vault. Guest access is the product, not a trial mode.
The browser is the vault
Web Crypto runs AES-256-GCM on the device. You can inspect the network tab: generation, audit, cleaning, and file work do not upload plaintext.
Burn links split ciphertext from the key
Only ciphertext is stored. The key rides in the # fragment so it is not sent as part of the request.
MyPassGen