EEvlarSoft

Password Generator & Breach Checker

Generate a memorable passphrase, random password or PIN on your own PC, type it into any field with a shortcut, and find out whether your current passwords have leaked.

Buy for $1.99
One payment. No subscription.
14-day money-back guarantee.
5.0
Click the lock for a strong new password.
Press Ctrl+Alt+P to type one into any app.
Check a password you already use against known data breaches.
Find the saved passwords that are breached, reused or weak.
Paste a site's password rules and every password follows them.
Passphrases, random passwords or PINs, made your way.

Click the lock for a strong new password.

190,000+downloads of EvlarSoft apps
Signed by EvlarSoftVerified US publisher
14-day money-backNo questions asked
Updates includedNo upgrade fees

A passphrase generator that runs on your PC, not in a web page

A passphrase generator strings together random words, like Quarry-Velvet-Ember-Lantern-41, and the result is both harder to crack and easier to type than a short jumble of symbols. Most generators that rank for the term are web pages, which means trusting that a site you just found is not keeping what it shows you.

Password Generator & Breach Checker makes every password locally with Windows' secure random source. Choose Passphrase, Random or PIN, then select the lock whenever you want another. Beneath it you see roughly how long an offline attacker would need to crack it, anywhere from seconds to centuries.

Passphrase words come from the EFF large wordlist, 7,772 words once the hyphenated ones are removed, so each word adds close to 13 bits of randomness. Pick 3 to 10 words, choose what sits between them, and leave Add a capital and a number on for sites that insist on both.

Random password generator and PIN generator

Some logins want raw characters. Random builds strings of 8 to 64 characters, and each of Capitals (A–Z), Lowercase (a–z), Numbers (0–9) and Symbols (!@#$%^&*-_=+?) has its own switch. PIN makes number codes 4 to 12 digits long for phones, safes and door keypads.

Then there are sites with picky rules: 8 to 16 characters, must start with a letter, only a hyphen or underscore as symbols. Paste that text into The site's password rules, worded however the site wrote it. A short summary of how the rules were read appears, and every password made afterwards obeys them until the box is emptied. When a passphrase cannot fit, a random password is used instead and the app tells you so.

Type a strong password straight into the field

On a sign-up form, press Ctrl+Alt+P and a new password is typed where your cursor is, in any browser or app. The same password is shown in the window, ready to save in your password manager. You can change the shortcut under Typing and checking. Closing the window leaves the app in the notification area, so the shortcut stays live.

If you copy instead, the clipboard empties itself half a minute later and the password never lands in clipboard history.

Has my password been leaked? Check one, or all of them

Paste any password into Check one you already use and select Check. You get a count of how many times it appears in Have I Been Pwned's breach data and an estimate of its strength. Only 5 characters of its SHA-1 fingerprint go out; the match is made on your machine.

For a full password checkup, choose Check all my saved passwords and open a CSV export from your browser or password manager. The list shows every login that was found in a breach, is shared between sites, or is easy to guess. Each row has Change, which opens the site's change-password page, and Copy a strong one, which puts a fresh password on the clipboard. When you finish, Delete removes the export for good, since it holds everything in plain text.

What you can make and check

  • Passphrases of 3 to 10 words from the 7,772-word EFF list
  • Five separators, including space and none
  • Random passwords of 8 to 64 characters with four character-set switches
  • PINs from 4 to 12 digits
  • Site rules typed in plain words are enforced on every new password
  • Crack-time estimate based on 10,000 guesses a second
  • Ctrl+Alt+P, or a shortcut you choose, types a password anywhere
  • Single-password breach lookup and full CSV check-up
  • Breach checks can be switched off in Settings

Good moments to open it

Creating a new account

Press the shortcut in the password box and a unique password is filled in before you reach for the mouse.

A Wi-Fi or master password

Make a five- or six-word passphrase you can read off a card to a guest or remember yourself.

After a breach in the news

Run the check-up on your browser export to see which saved passwords have leaked and fix them one by one.

What's new in 2.0.3

  • New: passphrases and PINs, as well as random passwords
  • New: press Ctrl+Alt+P to type a fresh password into any app
  • New: paste a site's password rules and every new password follows them
  • New: check a password you already use against known data breaches
  • New: password check-up for exports from Chrome, Edge, Firefox, Bitwarden and 1Password
  • New: the clipboard clears itself 30 seconds after you copy
  • New: light and dark themes

Questions

Anything else? Ask us

Where do the passphrase words come from?

From the EFF large wordlist, picked with Windows' own random number source. The four entries that contain a hyphen are left out, so 7,772 words are used, and a passphrase can have 3 to 10 of them.

Can it make a password that meets a site's rules?

Yes. Paste the rules the way the site words them, such as 8 to 16 characters or no symbols, and every new password follows them until you clear the box. Each password is checked against the rules before it is shown.

How is the time to crack worked out?

It assumes an offline attack at 10,000 guesses a second against a slow password hash. For a password it makes, the estimate comes from how many choices went into it; for one you type in, it uses the zxcvbn strength estimator.

Can it type a password straight into another app?

Yes. Press Ctrl+Alt+P, or a shortcut you pick, and a fresh password is typed into the field you are in. Closing the window leaves the app in the notification area so the shortcut keeps working.

Does checking a password against Have I Been Pwned send my password?

No. Only the first 5 characters of the password's SHA-1 hash are sent, and the match is found on your PC. Breach checks can be turned off in Settings.

Which password exports can the check-up read?

CSV exports from Chrome, Edge, Firefox, Bitwarden and 1Password. It flags passwords found in breaches, reused on more than one site or easy to guess, and in Firefox exports, passwords not changed in over a year. It can delete the export file when you are done.

Is a passphrase more secure than a random password?

At the same effort to remember, yes. Each random word from a 7,772-word list adds about 12.9 bits, so five words give roughly 64 bits, more than a typical 10-character password people can actually memorize. A long random password is stronger still if you store it in a manager.

How many words should a passphrase have?

Five words is a sensible default for website logins. Use six or more for a master password or anything an attacker could test offline. The app goes from 3 to 10.

Does the generator need an internet connection?

No. Passwords, passphrases and PINs are made entirely on your PC. Only the breach check contacts Have I Been Pwned, and you can turn it off.

Which versions of Windows does it run on?

Windows 10 (version 1809 or later) and Windows 11.

Is it a subscription?

No. Password Generator & Breach Checker is a one-time purchase of $1.99, and updates are included.

How do I get it?

Buy it on this page and your license key arrives by email. If the button says Notify me, Password Generator & Breach Checker is not on sale here yet; leave your email and we will tell you when it is.

Prefer widgets? The Password Generator widget on WidgetSpark does a similar job, alongside over 100 other desktop widgets in one app.