✳ XDataCore tools
Secure password generator
Create random, strong and unique passwords in one click. Choose the length and the character types, then copy it. Everything happens on your device: the password is never sent, stored or logged.
Prefer to use it with no ads and no audience measurement? Open the generator on its own page
Why you can trust this generator
Cryptographic randomness
Every character is chosen with your browser’s cryptographic generator (crypto.getRandomValues), fed by the operating system. We never use Math.random or any formula that can be reproduced.
Unpredictable, even if you know the code
The code is public and holds no secret. The only secret is your device’s random numbers, and those never leave it. Every character is also exactly equally likely: there is no bias to exploit.
Nothing leaves your device
The generator is a standalone page with a security policy that blocks every network connection. There is no server, database, log or history: close or reload and the password is gone.
Isolated from ads and analytics
The generator is shown inside a frame that is isolated from the rest of the page. The advertising and audience-measurement code cannot read what is generated inside it.
Tips for your passwords
Use a different password for every account: if one leaks, the others stay safe.
Favour length: 16 characters or more with letters, numbers and symbols.
Keep them in a password manager, not in notes or e-mail.
Turn on two-step verification on your important accounts.
Never send passwords by chat or e-mail.
Password questions
Is it safe to use an online password generator?
It depends on where the password is generated. This generator creates it in your browser, not on a server, and the generator page blocks every network connection, so the password cannot leave your device.
Does XDataCore store or see my passwords?
No. They are never sent, stored or logged. There is no history either: reload the page and the previous password no longer exists.
Can someone guess the password if they know the generator’s code?
No. The code only says how characters are chosen; the choice is made by your device’s cryptographic generator. With 20 characters there are more possible combinations than all of today’s computing power could try.
How long should a secure password be?
At least 12 characters, and preferably 16 or more. Every extra character multiplies the possible combinations. The generator’s meter shows the strength in bits of entropy.
What are bits of entropy?
They measure how hard the password is to guess: every bit doubles the attempts needed. Below 50 bits is weak; above 80 it resists known brute-force attacks.
What is “avoid look-alike characters” for?
It removes characters that are easy to confuse when read or dictated, such as lowercase l, uppercase I, 1, O and 0. Useful if you will type the password by hand.
How do I remember such a long password?
You do not need to: keep it in a password manager and memorise only the manager’s master password.