Random passwords, memorable passphrases and PINs — generated with your browser's cryptographic randomness, scored with real entropy maths, and never sent anywhere.
Click the password to copy it.
4–128 characters. 16 or more is recommended.
Handy when a site rejects certain symbols.
Six random words are easy to type, easy to remember and hard to crack. Each word adds about 11 bits.
PINs are short by design — pair them with a device that locks after a few wrong attempts.
Scored in your browser. Nothing you type is sent anywhere or remembered.
What you generated with the button and what you copied, kept in memory only so you can grab it again. Closing or reloading the page wipes it.
Every character comes from
crypto.getRandomValues() with rejection sampling, so
there is no modulo bias and no predictable seed — unlike
generators built on Math.random().
Instead of a vague "strong" badge you get the actual entropy in bits and an estimated cracking time for an offline attacker making 100 billion guesses per second.
No accounts, no analytics, no network requests. Your settings are saved locally so the generator is ready the way you like it next time; the passwords themselves are never stored.
FortiPass is a progressive web app. Add it to your home screen or desktop and it keeps working on a plane, in a server room or with the network unplugged.
No. Everything happens in your browser tab. Passwords are created locally with the Web Crypto API and are never transmitted, logged or stored on a server. You can open your browser's network panel and watch it stay empty.
For anything stored in a password manager, use 16 characters or more with all character types — that is over 100 bits of entropy and out of reach of brute force. For a password you have to type from memory, a five or six word passphrase is a better trade between security and your patience.
Entropy is a measure of unpredictability expressed in bits. Each additional bit doubles the number of guesses needed. Around 60 bits is reasonable for everyday accounts, 80 bits is strong, and 100 bits or more is excellent for essentially any threat model.
Yes, provided the words are picked at random by a computer rather than by you. FortiPass selects from a curated list of more than 2,200 words using a cryptographic random number generator, so every word adds about 11 bits: six words is roughly 67 bits. The figure shown under your passphrase is calculated from the real list size, not guessed.
Yes. After the first visit the app is cached on your device, so it loads without a connection. Most browsers will also offer to install it — look for "Install app" or "Add to Home Screen".
No. The check runs on heuristics and entropy maths that ship with the page — character variety, length, repetition, sequences, keyboard patterns and a list of very common passwords. Nothing is sent over the network and nothing is kept after you close the tab.