Tool 01 — Passphrase generator
Roll the dice.
Diceware passphrases and random passwords, drawn from your browser's CSPRNG. Nothing is sent, stored or logged — this origin isn't even allowed to open a network connection.
02 — Time to crack
How long it holds.
Average time to find it — half the keyspace — assuming the attacker knows exactly how it was generated. Rates are orders of magnitude, not benchmarks.
03 — Don't trust, verify
Nothing leaves.
- connect-src 'none' The page's CSP forbids every fetch, XHR, WebSocket and beacon — even to this origin.
- no storage No cookies, localStorage or IndexedDB. Settings reset on reload, on purpose.
- CSPRNG
crypto.getRandomValueswith rejection sampling — no modulo bias. - one origin Nothing else runs on
passwd.entropywatch.dev; no third-party code at all.
- Tries to break out of the sandbox and reports what the browser stopped.
04 — Why it works
Short answers.
What is "bits of entropy"?
The number of yes/no coin flips an attacker has to get right. Every extra bit doubles the work. Six words from a 7776-word list give 7776⁶ ≈ 2⁷⁷·⁵ possibilities — and that holds even if the attacker knows the list and the method.
Why words instead of X7#q!?
Per character, random symbols carry more entropy, but you'll type and remember words. Length beats complexity: correct-horse style phrases reach 70–90 bits without a sticky note. Use random passwords where a password manager types them for you.
How many bits do I need?
Accounts that can only be attacked online, behind rate limiting: 50+ is plenty. Anything whose hash can leak and be attacked offline — a domain account: 75+ (six words). A password manager master password, disk encryption or an SSH key passphrase: 90 (seven words). The long version, with the math and where offline attacks happen on a Windows network: How long should a passphrase be?
Should I trust a website for this?
Healthy suspicion. That's why this page can't talk to the network and has a self-test. Better still: use it offline (load it, then disconnect) or roll physical dice with the EFF list.