Cybersecurity tools

What these tools are quietly trying to fix

The reason most people end up with bad passwords isn't laziness. It's that the security advice they've been given for the last twenty years has been a moving target, often contradictory, and almost always delivered as a scolding rather than an explanation. "Use a strong password" is not advice if nobody tells you what strong means. "Change it every ninety days" was the official guidance for a decade, then quietly reversed by NIST when the data came in showing it made things worse. No wonder people pick "Password1!" and call it a day.

The tools here try to replace the scolding with something measurable. Entropy in bits, a number you can actually compare. Crack-time estimates against three different threat models, because "an attacker" covers anything from a teenager with a laptop to a state-sponsored cluster. A breach risk score that asks about your real habits rather than your aspirational ones. None of it requires a security degree. All of it gives you something concrete to act on.

Where the inputs come from

For password tools, the input is the password itself, and the only sensible place for it to be assessed is on your own machine. That's why the Password Strength Calculator and the Password Generator never call out to a server. The breach-list lookup uses the k-anonymity API model, where only a partial hash prefix leaves your browser, never the full password.

For breach risk and cost estimation, the inputs are the ones nobody likes writing down: how many staff, how many records of personal data, what sector you sit in, what your detection and response posture genuinely looks like. Be honest about it. The Data Breach Risk Score is only as useful as the answers you put in, and the temptation to tick "yes we patch promptly" when really it's "we get to it eventually" is the same temptation that causes the breach in the first place. Pull patch logs, MFA coverage reports, and incident-response runbook dates if you have them. If you don't, that absence is itself a finding.

Mistakes that turn good intentions into bad outcomes

The first is reusing passwords across sites. One breach somewhere unimportant becomes a breach of your email, your bank and your work account, all in the time it takes an attacker to run credential stuffing. A password manager and a unique password per site is the single highest-impact change most people can make. The Diceware-style passphrases this section can generate are designed to be memorable for the handful you actually have to type by hand: the master password, the device unlock, the recovery codes you keep on paper.

The second is treating two-factor authentication as a tickbox. SMS-based 2FA is meaningfully better than nothing, but SIM-swap attacks are a real and current threat. App-based or hardware-token 2FA is genuinely strong. The 2FA / TOTP Window Calculator lets you reason about the acceptance window your service is using, which is the kind of detail most "is 2FA enough" conversations skip.

The third is forgetting about certificates. An expired SSL certificate is, depending on the day, either an embarrassing afternoon or a full-day outage that costs real revenue. Renewals get missed because the calendar reminder lived in someone's inbox who left two years ago. The SSL Certificate Expiry Calculator gives you a renewal-by date well in advance of the actual expiry, which is the only date worth caring about.

Picking between the tools

If you're worried about a single password, start with the strength calculator. If you need a new one, the generator. If you're worried about your overall posture, the breach risk score gives you a prioritised fix list. If you're building a business case for security spend, the breach cost estimator gives you a defensible range to put in the slide deck. Each tool answers one clear question, which is the only honest way to do this.

Why a browser-only password tool is the only kind worth using

Plenty of "free password generator" sites work by sending your generated password back to the server, or logging the seed they used. Even when they don't, the password has briefly existed on someone else's machine. For a tool whose entire purpose is generating something nobody else should ever see, that is the wrong architecture.

Everything in this section uses your own browser's cryptographic primitives: the Web Crypto API for hashing, crypto.getRandomValues for entropy, and pure JavaScript for the rest. If your Wi-Fi dropped while you were generating a password, the tool would still work. Open the page, disconnect, generate a password, copy it, close the tab. Nothing leaves the device.