Passwords
8–128 characters, per-set minimums, ambiguous-character exclusion, and eight presets for the services that impose their own rules.
macOS 14+ · Apple silicon & Intel · Free
Strong credentials, generated on your own Mac.
KeyStrong makes passwords, passphrases, SSH keys and tokens from the same random source macOS uses for its own cryptography. No account, no sync, no server. The app has no way to reach one.
Get KeyStrong on the Mac App Store Free · no subscription, no in-app purchases
Never leaves your Mac
The app ships without the network entitlement.
KeyStrong runs in the macOS App Sandbox with no outgoing or incoming network permission. It cannot phone home even if it wanted to; the capability isn't in the binary. Generation happens in memory; nothing is written to disk unless you save it yourself.
Read the security architecture → 0 Network requests No sandbox network entitlement, inbound or outbound.
0 Accounts No sign-up, no email, no licence server.
0 Analytics SDKs No telemetry, crash reporters or third-party code.
What it does
Six tools, one window
Passphrases
Diceware over the EFF 7,776-word list. Three to twelve words, your separator, optional capitals and an appended digit or symbol.
Analysis
Paste anything you already use. KeyStrong reports true entropy and flags dictionary words, keyboard runs, repeats and dates. All of it locally.
Developer utilities
UUID v4 and v7, hex blobs, API tokens with prefixes, TOTP secrets, recovery-code sets and SSH key material.
Menu bar quick-gen
A keyboard shortcut generates and copies without opening the window. The clipboard clears itself on your timer.
Session history
The last generations stay available while the app is open, held in memory only, and vanish on quit. Nothing is persisted.
The window
Every tab, as it actually looks
Passphrase
Diceware over the EFF long list
Six words drawn from 7,776 gets you 78 bits. Choose the separator, add capitals or a trailing digit when a form insists, and you end up with something you can read down the phone.
Analyse
Check what you already use
Paste an old password. KeyStrong reports its real entropy and names the reason it is weak: a dictionary word, a year, a keyboard run, a repeat.
Utilities
The things you keep opening a terminal for
UUID v4 and v7, hex blobs, prefixed API tokens, TOTP secrets, recovery-code batches and Ed25519 keypairs, without pasting anything into a website.
The arithmetic
Length beats cleverness
Offline attack at 100 billion guesses per second, roughly a well-funded GPU cluster working on a leaked hash. Substituting 3 for e buys you about one bit.
| Credential | Length | Entropy | Time to crack |
|---|---|---|---|
| Summer2019! | 11 | 28 bits | instant |
| Random alphanumeric | 8 | 48 bits | 47 minutes |
| Four-word passphrase | 4 words | 52 bits | 18 months |
| Six-word passphrase | 6 words | 78 bits | 96 million yr |
| KeyStrong default | 17 | 104 bits | 2.4 × 10¹⁴ yr |
Free, without the usual catch
No subscription, no trial timer, no Pro tier holding features back. KeyStrong sells nothing and collects nothing, so there is nothing to upsell you later.