Generate strong secrets without handing them to a server.
Generate and inspect secrets locally with browser cryptography. Ryo Password Toolkit does not need an account, a password history or server-side generation.
Generation and analysis stay on this device unless you explicitly run the HIBP breach lookup.
The generator refuses to fall back to insecure pseudo-randomness if cryptographic randomness is unavailable.
Generated passwords, PINs and tokens are not intentionally stored in cookies, localStorage or WordPress.
Choose a tool
Each page is a focused privacy-first utility with the same local-processing model.
Random passwords with live security controls.
→ Generate Passphrase GeneratorMemorable random words from a local EFF list.
→ Generate PIN GeneratorCryptographically random numeric codes.
→ Developer Token GeneratorHex, Base64URL and alphanumeric secrets.
→ Check Strength & Breach CheckerLocal analysis plus optional HIBP breach lookup.
→ Generate Wi-Fi Password GeneratorStrong typeable passwords for Wi-Fi networks.
→Secrets are safer when they never need to leave your device.
Ryo Password Toolkit uses the browser's cryptographic random number generator for new secrets. The Strength Checker performs local analysis first, and its optional breach lookup uses HIBP's k-anonymity range model instead of sending the password.
Math.random() fallback.Password Toolkit FAQ
Important details about randomness, storage and breach checking.
Are the Password Toolkit tools free?
Yes. The current password, passphrase, PIN, token, Wi-Fi and strength tools are free and do not require an account.
Does Ryo Tools store generated passwords?
No generated-secret history is intentionally written to WordPress, localStorage or cookies by this plugin. Generated values exist in the browser interface until you replace them, reload the page or close the tab.
What randomness does the generator use?
The generator requires the browser Web Crypto random-number generator. It does not fall back to Math.random() if secure randomness is unavailable.
Does the breach checker send my password to Have I Been Pwned?
No. If you explicitly start a breach check, the browser hashes the completed password locally and sends only the first five characters of its SHA-1 hash to the HIBP Pwned Passwords range endpoint.
