How We Test Our Tools
Every generator and checker on Flassword is verified before it ships. Here's exactly how.
A password tool that's subtly wrong is worse than no tool at all. Before any generator or checker on Flassword goes live, it goes through the same set of checks — this page explains what those are, in plain language.
Correctness against known test vectors
Wherever a tool implements a published standard — a hash algorithm, a UUID format, an encoding scheme — its output is checked against official test vectors for that standard before it ships. For example, our Hash Generator's MD5 implementation is verified against the complete official RFC 1321 test suite, and its SHA-family output is cross-checked against independent, trusted implementations to confirm the two agree byte for byte.
Randomness you can reason about
Every tool that generates something unpredictable — passwords, passphrases, PINs, UUIDs — uses your browser's built-in cryptographic random number generator (the Web Crypto API), not a weaker general-purpose random function. We test that character pools, word lists, and numeric ranges are sampled without bias, so the entropy we report is the entropy you actually get.
Privacy, verified
Tools described as fully private are checked to confirm they make no network requests at all while generating or checking your input. The one deliberate exception is our Password Breach Checker, which needs to query a breach database to do its job — even there, only a five-character fragment of a hash is ever transmitted, never the password itself, and that behavior is documented openly rather than buried in fine print.
Security review
Beyond correctness, we look at how each tool fails: what happens with empty input, extremely long input, unusual characters, or a slow network connection. A tool that breaks unpredictably under edge cases is a tool we don't publish yet.
Cross-browser and device validation
Tools are checked across current versions of major browsers and on both desktop and mobile viewports before publishing, since a generator that only works in one browser isn't a finished tool. Where a tool depends on a modern browser API, we note that dependency rather than letting it fail silently on unsupported browsers.
Performance
Every tool runs instantly and entirely in your browser — there's no server round-trip for the actual generation or checking logic, so performance is mostly a function of your device, not our infrastructure. We keep each tool's code lean and avoid loading anything a given page doesn't actually need.
Before publishing, every time
The checks above aren't a one-time setup — they're repeated whenever a tool changes. Our Editorial Policy covers the equivalent process for written content, and our Privacy Promise goes deeper on exactly what is and isn't collected while you use any tool on this site.