// local · client-side · zero server calls
Passwords a human can remember.
A search space a machine can't guess.
CHBS randomizes the words and the shape of every password — no two ever look alike. Everything runs in your browser with the Web Crypto API. Nothing is ever transmitted anywhere.
Press Generate to begin
Password History stored locally only
Nothing generated yet this session — history stays on this device only, and is off by default in a locked-down browser profile.
About CHBS
CHBS builds passphrases the way Diceware and the original Correct Horse Battery Staple comic intended — by drawing from a real dictionary rather than shuffling character soup — and then goes further by also randomizing the shape of the password: which template, which capitalization, which separators, which numbers. Two passwords generated back to back should never look like they came from the same machine.
How the entropy number is calculated
CHBS never displays "it would take N years to crack this password" — that framing depends on guesses about attacker hardware that go stale immediately. Instead, every generation is tracked bit-by-bit: each random decision the generator actually makes (which words, which capitalization, which digits, which characters) is logged the moment it happens, and the entropy shown is the exact sum of those decisions — click "Show entropy breakdown" above to see the full receipt.
Word selection uses the EFF long word list, filtered to 4–8 letter entries: 6,134 words, chosen specifically because they're clear to read, spell, and remember, with no easily-confused homophones.
Security model
CHBS is designed under the assumption that an attacker knows exactly how it works — every template, every word-list, every setting. Nothing here relies on secrecy of the algorithm. Security comes entirely from the search space and from the Web Crypto API's cryptographically secure randomness (crypto.getRandomValues), never from Math.random().
Runs entirely on your device
There is no backend. No password, setting, or word list is ever sent over the network — everything above happens in local JavaScript, and anything saved (history, preferences, custom word lists) lives in your browser's local storage until you clear it.