live · pass.azamatos.com
pass
Passwords that pass a site’s real password rules, made and checked in your browser.
- site presets, every rule with the page it was read from
- 16
- characters of the password’s hash the leak check sends
- 5 of 40
- of JavaScript on a site’s page, against a 14.0 kB budget
- 13.4 kB
- passwords stored, ever
- 0
Sizes from CI, which runs on every push and once a month; checked 28 Oct.
01 · what it does
Pick a site, and get a password its sign-up form accepts.
The right length, the character types it requires, only the symbols it allows, no more repeats than it permits. Passphrases for things you type by hand, and a check of how long a password would take to guess and whether it has leaked.
- Apple
- Microsoft
- GitHub
- Amazon
- X (Twitter)
- Spotify
- TikTok
- PayPal
- Netflix
- Shopify
- Steam
- Twitch
- Any site
02 · how it works
Everything runs in the browser. There is no backend and no account, and nothing is stored.
Random the right way
Characters come from crypto.getRandomValues with rejection sampling. Whole passwords are redrawn until they meet the rules, so no password is likelier than another.
Rules with sources
Each site’s rules come with the pages they were read from and the month they were checked. CI fails when a site’s rules are more than six months old.
The leak check sends 5 characters
Have I Been Pwned is asked with k-anonymity: only the first 5 hex characters of the SHA-1 hash leave the browser, padded so the answer’s size gives nothing away.
A strict Content Security Policy
Pages may connect only to the site, Have I Been Pwned and the analytics. The build fails on an inline script the policy would block.
No UI framework
Astro renders static HTML and plain TypeScript makes it interactive. The rules logic is framework-free and unit-tested.
03 · the health check
How long a password would take to guess, online and from a leaked database, and whether it has leaked.
04 · measured
Small enough to feel instant on a phone.
| what | result |
|---|---|
| JavaScript on a site’s page | 13.4 kB of 14.0 kB |
| JavaScript on /health | 10.7 kB of 11.5 kB |
| Lighthouse on a phone | performance 99–100, the rest 100 |
| Layout shift while a page loads | 0 |
| Switching pages, 200 ms network delay | on screen 15–70 ms after the click |
| Tests | 88 unit, 136 Playwright checks in 3 browsers |
gzip sizes, measured in CI; the word list and the strength worker load only when first needed.
05 · built with
site
- Astro 7
- TypeScript
- Astro client router
- Astro sitemap
Static HTML for every site’s page, with plain TypeScript for the generator and the check.
security
- Web Crypto
- zxcvbn-ts
- Web Worker
- Have I Been Pwned
- strict CSP
The password never leaves the browser; the strength worker loads on the first check.
build
- Satori
- resvg
- Cloudflare
A share image is made for every page at build time.
quality
- Vitest
- Playwright
- axe
- Lighthouse CI
- GitHub Actions
Tests make 1,000 passwords per site and check each against its rules; CI also runs once a month.
06 · what shipped
- generator, done:a password each site’s form accepts
- passphrases, done:for things you type by hand
- health, done:time to guess, online and offline
- leak check, done:5 characters of the hash, or nothing
- themes, done:system, light and dark, axe in both
rules it keeps
- No backend and no account: the list of copied passwords lives in the open tab and is gone on reload.
- Every site rule has a source and the month it was checked.
- The leak check can be turned off, and then nothing is sent.