The short answer: we made a free password generator that creates strong random passwords and passphrases entirely in your browser. Nothing is generated on a server, nothing is logged, and it keeps working with your internet switched off. No account, no ads, no tracking. It’s free for everyone, whether you ever use OutVault or not.
This is the first of what we’re calling tools for the community — small, free, genuinely useful things we build and give away. Here’s the story behind this one.
Why we built it
While building OutVault we generate a lot of passwords — for test accounts, for services the team uses, for the vault itself. Like most people, we’d type “password generator” into a search engine and use whatever came up.
Then it occurred to us what we were actually doing: asking an unknown website to invent a secret for us. Most online generators are fine. But “most” and “fine” are strange words to accept for the string that guards your email. If the password is created on someone’s server, you are trusting that server not to log it. If the page is full of trackers, you are trusting every one of them too. There is no way to check from the outside — the whole thing runs on trust.
That’s the same problem OutVault exists to remove from file storage. So we built the generator the way we build the vault: it should not need your trust, because it never gets the chance to betray it.
What “never touches a server” actually means
The generator is a page of code that runs on your device. When you press “New”, your own browser draws randomness from crypto.getRandomValues — the cryptographic source password managers use — and assembles the password right there on your screen.
There is no request to generate. No request when you copy. No analytics attached to the value. And you don’t have to take our word for any of that, which is the part we care about most:
- Open your browser’s network tab and generate a few passwords. Nothing is sent.
- Or load the page, switch on airplane mode, and keep generating. It works, because there is nothing on the other end.
A few details we sweated because they matter:
- No modulo bias. Characters are drawn with rejection sampling, so every character is exactly equally likely. Naive generators lean slightly toward the start of the alphabet. Ours doesn’t.
- Passphrases use the EFF wordlist — 1,296 words the Electronic Frontier Foundation chose to be memorable and easy to type. Five random words give you about 52 bits of entropy and something you can actually remember.
- Every option is honest. The strength meter shows real bits of entropy, not a cheerful green bar. Eight characters says “Fair” because eight characters is fair.
The honest limits
A generator solves exactly one problem: inventing a strong secret. It does nothing about the harder ones. A strong password reused across sites falls with the first site that leaks. A strong password typed into a phishing page is gone in one keystroke. And a strong password kept in a text file on your desktop is only as private as that desktop.
Generation is the easy step. Storage is the real problem — and that one we’re working on somewhere else.
Why free, and what’s next
Because it costs us almost nothing to give away, and because this is the kind of internet we’d rather use: small tools that do one thing properly, explain themselves, and don’t take anything from you in return. If the generator is the only OutVault thing you ever use, that’s a perfectly good outcome.
More tools for the community will follow when we find ones worth building. If there’s a small privacy tool you wish existed, tell us — the best ideas so far have come from people using our things in ways we didn’t expect.
Frequently asked questions
Is it really free? What’s the catch?
Free, no catch. No account, no email, no premium tier of the generator. It’s a static page — it costs us nearly nothing to host, and it’s our way of being useful to people who care about the same things we do.
Does it work offline?
Yes. Once the page has loaded, you can switch off your connection and generate as many passwords as you like. That’s the simplest proof that nothing leaves your device.
Where should I keep the passwords it makes?
In a password manager or an encrypted vault — anywhere except a plain note or a reused memory. OutVault stores passwords end-to-end encrypted, sealed on your device before anything syncs, and the free app does this on Windows, Android and Chrome. But any reputable password manager beats no password manager.