Guide
How to generate strong passwords in the browser
What Generate does on this site, how to read the strength meter, and why we don’t store a vault.
The Password Generator on Tokitool is intentionally boring: length slider, character toggles, a strength meter, copy button, and a short session-only history. There is no account, no “cloud vault,” and no network call when you click Generate. This guide explains why those constraints existand how to use the tool without shooting yourself in the foot.
What the button actually does
Each password is built with crypto.getRandomValues() (the browser’s cryptographic random number generator), not Math.random(). We chose that API because credential generation is exactly what it is for. If you inspect the page while generating, you should not see your new password leave the tab.
History exists so you can recover the last few strings if you copied the wrong one. It lives in memory for the tab and goes away when you close it. It is not written to localStorageon purpose.
Settings that match real signup forms
- Length: push it up first. A longer random string beats a short “clever” one. If a site caps length, use the maximum it allows.
- Symbols: enable when the site accepts them; disable when the site’s own error message bans them. Fighting the form wastes time.
- Avoid ambiguous characters: useful when you must read a password aloud or type from paper. Less useful when a password manager will paste for you.
Strength meter: signal, not theater
The meter on the page reflects length and character-set breadth for the current string. It is a teaching aid, not a laboratory estimate of years-to-crack against a specific attacker. Treat “excellent” as “this configuration looks sane,” then store the password properly.
Generation is not storage
Tokitool will not remember the password next week. Copy once paste into the signup or password-change form save in a password manager (or the browser’s password store) immediately. Do not email the string to yourself “as a backup.”
If you only needed a Wi-Fi password to share with guests, a Wi-Fi QR code may be safer than texting the key. Still treat the printout as public credentials.
How this differs from sketchy generators
Be wary of tools that generate on a server and display the result, require an account before copy, or bundle a “security score” with an upsell. Our generator’s job ends at creating a random string in your browser. That narrower scope is the product.
Written about Tokitool’s Password Generator implementation and UI. General password hygiene advice here is tied to how this page behaves, not copied from another site’s checklist.