Security & threat model
A short, honest description of what runs where, what NewPw is and isn’t designed to defend against, and how to verify any of these claims for yourself.
How a password is generated
When you load https://newpw.pro/, your browser receives a single static HTML file containing the markup, styles, and JavaScript required to run the generator. From that moment on, the generator is fully local:
- Random bytes are produced by
window.crypto.getRandomValues, the browser’s cryptographically secure pseudo-random number generator. This is the same source used for TLS key material in the browser itself. - Those bytes are mapped onto your selected character set (random mode) or onto indices into a BIP39 wordlist (passphrase mode).
- The resulting string is rendered into the page’s output box. It is held in JavaScript memory only, scoped to that page.
- Closing or reloading the tab discards it. There is no persistence layer.
What crosses the network
- The initial HTTPS request for the page itself.
- If you switch to passphrase mode in a non-default language, a second HTTPS request fetches the corresponding wordlist file from the same origin (e.g.
/wordlists/czech.txt). - HTTPS requests for the favicon, the touch icon, and the Inter font from Google Fonts.
Generated passwords and passphrases never appear in any network request. They are not in URLs, not in form submissions, not in analytics events, not in error reports.
Threat model
What NewPw protects against
- Server-side leakage of generated values. There is no server-side generation, so there is nothing to leak.
- Operator curiosity. The site operator cannot read your generated passwords because they never leave your browser.
- Network observers between you and the site. Even an attacker who could see your full TLS plaintext would not see any generated value.
- Predictable randomness. The Web Crypto API draws from the operating system’s CSPRNG, which is hardened against state recovery and timing attacks.
What NewPw cannot protect against
- A compromised browser or operating system. If your device is running malware that can read DOM contents or keylog your clipboard, no web-based generator can help.
- A hostile browser extension. Extensions with broad host permissions can read page content. Disable or audit extensions for any tab where you handle credentials.
- Server compromise that swaps the page itself. If an attacker replaces the served HTML with a backdoored copy, that copy could exfiltrate values. Subresource Integrity is not yet in use; this is a known gap, see “Verification” below.
- Shoulder-surfing and physical observation. The generated password is visible on screen until you copy and use it.
Verification
You don’t need to take any of this on trust. To verify the claims above:
- Open browser DevTools → Network tab, then generate a password. Confirm that no network request is made.
- Use View Source on the page. The generation logic is plain, unminified JavaScript inside the same HTML file.
- Save the page (
Ctrl/Cmd-S, “Webpage, complete”) and disconnect from the network. The generator continues to work, confirming there is no server round-trip.
Known gaps and roadmap
- Subresource Integrity (SRI): the Inter font is loaded from Google Fonts without SRI. Self-hosting the font is on the roadmap, both to remove the third-party dependency and to enable a strict Content Security Policy.
- Content Security Policy: a strict CSP that blocks all third-party origins and inline scripts would harden the site against tampered copies. The current page uses inline JavaScript, so CSP tightening is incremental.
- Analytics: the production deploy currently includes Google Analytics for usage counts. This does not capture generated values, but it is a third-party request. Migrating to a privacy-preserving alternative (or removing analytics entirely) is on the roadmap.
Responsible disclosure
If you find a security issue, please email rothanzl@gmail.com with the subject line “NewPw security”. Please give the maintainer a reasonable window to respond before publishing details. There is no bounty program, but credit will be given on this page on request.