About CipherGuard

CipherGuard is a collection of password and secrets security tools — a strong password generator, a memorable passphrase generator, a PIN generator, a real-world password strength checker, a data-breach checker, and a password policy validator. Every operation runs entirely in your browser. Runs in your browser — your passwords are never transmitted.

Why “client-side” is the whole point

A password is the most sensitive thing you type. Generating or checking one on someone else's server is a trust failure — you'd be sending the very secret you want to protect to a stranger. CipherGuard generates and checks passwords on your own device. There is no backend and no server of our own. You can even use every tool offline after the first load, because it is an installable PWA.

How the breach check stays private

The breach checker uses Have-I-Been-Pwned's k-anonymity design. Your browser hashes the password with SHA-1 locally, then sends only the first five hex characters of that hash to the public HIBP API. The API returns every leaked suffix that shares that prefix (hundreds of them), and your browser checks for a match locally. The full password — and even its full hash — never leaves your device. It is the only outbound request the app ever makes, and it carries no usable password data.

Browse the tools

• Generate

  Create strong passwords, passphrases, PINs, and pronounceable secrets with WebCrypto.

• Check

  Score a password's strength and check it against known data breaches — nothing leaves your device.

• Policy

  Validate a password against configurable NIST-style rules and a common-password blocklist.