Password generator questions

No. There is no request that could carry one. The generation happens in your browser, and this product’s Content-Security-Policy restricts the page to its own origin, so the browser itself blocks any attempt to send data elsewhere. The only network activity is downloading the static word list files.

For most everyday accounts, yes, provided the page generates locally and you trust the machine you are on. ToolAcre generates passwords locally in your browser. For highly sensitive environments, verify your browser, device and operating system are trusted before using any web-based password generator — a compromised device can read anything on screen regardless of how the password was produced.

Yes. Each word is an independent draw from the full eligible pool, so repeats happen occasionally and are expected. Excluding them would look neater and would quietly make the result weaker than the entropy figure claims.

Browsers only allow clipboard writing in certain conditions — a secure connection, a genuine click, and the tab in focus — and some privacy settings and extensions disable it entirely. Select the passphrase and copy it by hand instead; the value on screen is exactly the value to use.

Because your browser did not provide a cryptographic random number generator, and this page will not fall back to a weaker source. A password that only looks random is worse than none, since you would trust it. Updating the browser, or opening the page in an ordinary window rather than a restricted or embedded one, usually restores it.

Yes. All three are the published Electronic Frontier Foundation lists, shipped as static files with this page and used under CC BY. The long list holds 7,776 words and the two short lists hold 1,296 each. One change has been made: the EFF publishes each list with a dice-roll column beside the word, and that column has been removed. The words are unchanged.

On paper, kept somewhere only you can reach, is far better than reusing one you can remember. Better still is a reputable password manager, so every account gets a different password and you only have to remember the one that unlocks it. No vendor is recommended here.

Change the separator to a hyphen or underscore, or drop a word, and generate again. Do not edit the passphrase by hand to fit — hand edits are exactly the predictable kind of change that weakens it.

Yes, and this matters more than length. Reuse is what turns a single site’s breach into a problem everywhere, and no amount of entropy protects against it. This is the reason to use a password manager rather than your memory.

When there is a reason: a breach notice, a shared or lost device, a suspicion that something is wrong. Changing on a schedule reliably produces weaker passwords, because people cope by incrementing a number on the end.

Once the page and the word list you are using have loaded, generating needs no further network access. Switching to a list you have not used yet in that tab does require downloading it.

Strength meters score the characters they can see, because they have no way to know how the password was made. Lowercase dictionary words look exactly like what those meters are built to warn about, even when the words were drawn at random and the result is far stronger than the mixed-character password the meter would praise.