Skip to content
KlehVaultKey home
Runs 100% in your browser

Passwords that are actually unguessable

Kleh generates cryptographically secure passwords and passphrases with the same randomness source your browser uses for TLS, then shows you exactly how long each one would survive a real attack.

  • Zero network requests
  • Nothing stored or logged
  • Web Crypto CSPRNG
CSPRNG
0 characters
Password strengthVery weak
Security level

Recommended default for important accounts.

20 chars

4–128 characters. Every extra character multiplies the search space by 90.

Character sets
Uppercase

A-Z

Lowercase

a-z

Numbers

0-9

Symbols

!@#$%^&*

Readability
Exclude similar characters

Removes O 0 o I l 1 | and quote marks.

Exclude awkward symbols

Drops brackets, slashes, and quotes that break shells and CSV imports.

Require one of each set

Satisfies strict site rules. Slightly reduces true entropy, so the estimate shown is an upper bound.

Added to the pool alongside your selected sets. Duplicates and spaces are ignored.

Threat model for the crack estimate

Unsalted SHA-1/MD5 dump on a GPU cluster, 1 trillion guesses/sec

Entropy0 bits
Character pool90
Time to crackinstantlyOffline, fast hash
Security score8/100
Security score8/100
  • Length0/40
  • Entropy0/40
  • Character variety0/12
  • No obvious patterns8/8
  • Pool size: 90 unique characters, drawn 20 times independently.
  • Strong Password Creator locked
  • Security Expert locked
  • Length Believer locked
  • Maximum Protection locked
Developer mode

Reveals the entropy math, generation method, and caveats behind every number.

Session history

Kept in memory only. Never written to disk, cookies, or local storage, and erased when you close or reload this tab.

History is off. Nothing you generate is retained anywhere.

Your password is the first lock protecting your digital life.

Habits that matter more than the password itself

A perfect password on a reused account is still a liability. These six practices cover most real-world account takeovers.

Use a password manager
You cannot memorize 80 unique random passwords, and you should not try. A manager means every account gets its own high-entropy secret and you only remember one.
Never reuse a password
Reuse turns one breach into many. Credential-stuffing tools replay leaked pairs across thousands of sites within hours of a dump appearing.
Turn on two-factor auth
An authenticator app or hardware key means a stolen password alone is not enough. Prefer TOTP or a passkey over SMS, which is vulnerable to SIM swaps.
Let a machine pick
Humans reach for names, dates, and keyboard runs. A CSPRNG has no such bias, which is why generated secrets outperform clever ones.
Prioritize length over symbols
Adding characters grows the keyspace exponentially. A 20-character lowercase password beats an 8-character password packed with punctuation.
Adopt passkeys where offered
Passkeys replace the shared secret with a private key that never leaves your device, so there is nothing phishable to steal.
The math, explained
No hand-waving. Here is precisely what the numbers on this page mean.