Frequently asked questions
Everything about the safety of the service, storing passwords, two-factor protection and what to do after a breach.
Questions
The service, storage and security
Do you store generated passwords?
No, and technically we cannot: generation happens entirely in the browser and not a single character reaches the server. The recent-password list lives in the tab memory and disappears with it — no cookies, no localStorage.
Can a password generator on someone else’s site be trusted?
Check three things: the page keeps working with the network off, no outbound requests appear in the console while generating, and the source code is open to read. Our code sits in assets/js and takes ten minutes to review.
Should I change passwords every 90 days?
No. Current guidance, including NIST SP 800-63B, dropped scheduled rotation: it produces predictable variations like “Summer2026!” → “Autumn2026!”. Change a password after a breach, after losing a device or when you suspect compromise.
What should I do if my password appears in a breach?
Change it on that service and everywhere it was reused, switch on two-factor protection, review active sessions and linked devices. Do your email first: it is the recovery path to everything else.
Which password manager should I choose?
Any one you will actually use: Bitwarden and KeePassXC are free and open, 1Password is convenient for families, and the browser vault beats a text file. What matters is one long master password and two-factor protection.
Is two-factor protection mandatory?
For email, banking, government services and work accounts — yes. An authenticator app or a hardware key beats SMS, because text codes are intercepted through SIM swapping. Store the backup codes in your password manager.
How do I share a password with a colleague safely?
Through shared access in a password manager or a one-time link service. If you have to read it out loud, use the speaker button on the generator page: the service spells the password with the radio alphabet.
Is a password in Cyrillic stronger?
The alphabet is formally larger, but few services accept Cyrillic, you cannot type it on a foreign keyboard layout and it breaks in legacy systems. Adding two or three characters of length is a better trade than risking access.
Next