About these tools
What this site does, how the checks work, and the rules we follow.
What we do
generatepassword.eu offers free tools for creating strong passwords and diagnosing DNS, e-mail authentication and website security settings. There are no accounts and no paywalled results.
How the checks work
- Passwords are generated in your browser with the Web Crypto API. The server never sees them.
- DNS lookups are sent from our server directly to public resolvers (Cloudflare, Google Public DNS, Quad9, Cisco OpenDNS, AdGuard) or to a domain's authoritative servers, using our own DNS client with timeouts. If our host blocks direct DNS, queries fall back to DNS-over-HTTPS with the same providers.
- Blocklist checks use only the lists listed on blocklist sources, through our server's own resolver.
- Web checks (SSL, headers, redirects) connect from our server. Before connecting, the host name is resolved and every address must be public; the connection is then pinned to that address. Private, internal and cloud-metadata addresses are refused.
- E-mail headers are parsed in memory and discarded after the page is built.
Results show the time they were checked. To avoid hammering DNS providers and list operators, results are cached for between 30 seconds and 15 minutes; cached results are labelled and can be refreshed.
Fair use and rate limits
To keep the tools available for everyone, each network can run a limited number of checks per 10 minutes. Heavier checks (blocklists, propagation) count more. If you hit the limit, the page tells you how long to wait.
JSON API
Every server-side tool is available at /api/v1/<tool> with the same parameters as its form, for example /api/v1/dns-lookup?domain=example.com&type=MX. Responses include checked_at and cached. The same rate limits apply. Please do not use the API for bulk scanning.
Third-party services
We use no analytics and no third-party fonts. To keep the tools free, some tool pages show Google AdSense ads after the consent choice required in the EU. Ads are never loaded on the home page, the password generator or the e-mail header analyzer, so no ad script can see a generated password or pasted headers. Data sources that would need a key, licence or approval (for example Spamhaus, Abusix, SpamRATS, Barracuda) are switched off unless explicitly configured.
Contact
See the imprint for contact details.