The Ultimate Password Generator

Short answer Yes — if the password is made inside your browser and never sent anywhere. Boltipass works exactly like that, and you can prove it yourself in 10 seconds.

Like you’re 6 It’s like rolling a dice in your own bedroom instead of asking a stranger to roll it for you. Nobody else sees the number.

More detail Many online generators run in your browser, but you shouldn’t have to take their word for it. With Boltipass you can switch on airplane mode and it keeps working — which proves nothing is being sent.

The site is a set of pre-built files. There is no server code that could receive a password.

Short answer No. Passwords are made on your device, shown on your screen and forgotten when you refresh or close the tab.

Like you’re 6 We hand you a magic dice. We never get to peek at what you roll.

More detail There’s no database, no account and no server code on boltipass.com.

If you allow them, Google Analytics and Hotjar count visits. They only receive page views, and the password box is masked and marked so Hotjar leaves it out of recordings. See the Privacy page for exactly how.

Short answer Try one of three tests: (1) switch on airplane mode and generate a password, (2) watch your browser’s Network tab stay empty, (3) read the connection rules in the page’s head.

More detail Step-by-step instructions are on the Privacy page under “Check it yourself”. The same tests work on any password generator — including ours and our competitors’.

Short answer Yes. Boltipass uses your browser’s cryptographic random generator (crypto.getRandomValues) — the same kind that creates HTTPS keys — and never Math.random().

Like you’re 6 It’s a perfectly fair dice with 85 sides, rolled once for every character.

More detail We also remove “modulo bias”, a subtle unfairness in many generators, by re-rolling the few values that would favour some characters.

When you require one of each character type, we simply re-roll until the password has them, so every valid password is equally likely.

Short answer Not unless you say yes. With your OK we use Google Analytics and Hotjar to count visits. If your browser sends “Do Not Track” or Global Privacy Control, we don’t even ask.

More detail No ads, no social-media pixels and no third-party fonts or widgets are loaded. Your settings (like password length) are kept in your browser’s local storage and never leave your device.

Short answer At least 16 characters for a random password, or 6 words for a passphrase. NIST’s current guidelines (SP 800-63B-4) tell websites to require at least 15 characters when a password is the only login step.

Like you’re 6 Every extra letter makes the secret about 85 times harder to guess — like adding another dial to a bike lock.

More detail Length beats cleverness. Some sites cap passwords at 12–16 characters; if so, use the maximum they allow.

For scale: a random 12-character password would take a very fast attacker about 17 thousand years to crack; 16 characters, longer than the universe has existed.

Short answer They help a little, but length helps far more. A random 20-letter lowercase password (about 94 bits) is stronger than a 10-character mix with symbols (about 64 bits).

More detail NIST’s guidelines also say websites should not force “one capital, one number, one symbol” rules — they push people towards predictable patterns like P@ssw0rd!. Use symbols when a site demands them; otherwise add length.

Short answer It counts how many times an attacker’s work doubles. 80 bits means there are 2^80 possible passwords — about a trillion trillion.

Like you’re 6 Each bit is one coin flip. Flip 80 coins in a row and try to guess every result — nobody can.

More detail Our scale: under 40 bits is weak, 40–59 fair, 60–79 good, 80–119 strong and 120+ excellent.

Short answer The estimate under the generator assumes a serious cracking rig making 100 billion guesses every second, and that it finds your password after trying half of all possibilities.

More detail A random 16-character password: longer than the universe has existed. A 6-word passphrase: about 35 thousand years.

Real websites slow guessers down enormously, so this is a deliberately pessimistic, worst-case number for stolen password files.

Short answer Choose Random, drag the length to 16–20, press “New password”, press “Copy”, then paste it into your password manager or the sign-up form.

Short answer A random password is a jumble of characters (best for accounts you keep in a password manager). A passphrase is several random words (best when you must type or remember it, like a master password or Wi-Fi). A PIN is digits only (only for devices that lock you out after a few tries).

Like you’re 6 Password = secret scribble. Passphrase = a silly sentence only you know. PIN = the number code on your tablet.

Short answer Characters that look alike in many fonts: I (capital i), l (lowercase L), 1 (one), O (capital o) and 0 (zero). Switch “Avoid look-alikes” on when you’ll read or type the password by hand.

Short answer Yes. After your first visit the site works offline, and it fits any screen size. On a phone you can add it to your home screen.

Short answer Yes — free, with no sign-up and no limits.

Short answer Some sites limit length or symbols. Try “Easy to type” (no symbols), or lower the length to the site’s maximum.

Short answer In a password manager — for example Bitwarden, 1Password, LastPass, KeePass, or the one built into your browser or phone. Don’t keep it in a notes app, an email or on a sticky note.

Like you’re 6 A password manager is a treasure chest with one super-secret key. You remember the key; the chest remembers everything else.

Short answer When one website is hacked, criminals try the same email and password on your other accounts — an attack called credential stuffing. A unique password for every account stops one leak from becoming many.

Like you’re 6 If one key opened your house, your bike lock and your school locker, losing it would be a disaster.

Short answer No — only change one when you think it has leaked. NIST’s guidelines advise against forced periodic changes because people respond with weaker, predictable passwords.

Short answer Yes. A strong, unique password plus two-step login stops the vast majority of account takeovers, and passkeys are better still wherever a site offers them.

Short answer Password managers’ generators are good, but they live inside a bigger product with accounts and vaults. Boltipass does one job: a fast generator with no account, no vault and no clutter — and its privacy claims are checkable in 10 seconds.

More detail If you want autofill and syncing, use a password manager as well — Boltipass is happy to be the place you make the password, and your manager the place you keep it.

Short answer Because the safest setup is a unique random password for every account, and nobody can remember dozens. We’d rather you stay safe than depend on us.