About iToolify

Updated 20 October 2026

What this site is

iToolify is a collection of 76 small utilities in three groups: Passwords (22) · Random numbers (32) · QR codes (22). There are 10 longer guides that explain the reasoning behind the defaults those tools use. Each tool has its own page, its own explanation and its own answers to the questions people ask about it, rather than being one tab in a generic generator.

The site exists because most generator pages online ask for something before they will generate anything — an account, an email address, a “free trial”, or at minimum a round trip to a server that now holds the password you were about to use. None of that is necessary. A password generator is a random number generator and a lookup table; both fit in a page that never talks to a server.

How the tools are built

• Randomness comes from the platform CSPRNG. Every random value on this site ultimately comes from crypto.getRandomValues(), not Math.random(). Where a value must fall in a range that does not divide evenly into a power of two, selection uses rejection sampling rather than a modulo operation, so no value is favoured.
• Nothing you produce is sent anywhere. The tools make one network request of their own — a static wordlist file on this domain, used by the passphrase generator — plus the analytics tag that every page carries. Passwords, numbers, names and QR images stay in the tab.
• QR decoding happens locally. The scanner prefers the browser's built-in BarcodeDetector and falls back to a JavaScript decoder bundled with the page. Camera frames are never uploaded, recorded or written to storage.
• Content is validated at build time. Adding a tool means adding an entry to a data file. The build fails if a title is too long for a search result, if a description exceeds the meta limit, if a page has fewer than three FAQ entries, or if a related link points at a page that does not exist. Broken internal links cannot ship.
• The pages are static. No database, no user table, no login. There is nothing to breach because there is nothing stored.

What the site deliberately does not do

• It does not store, log or transmit anything you generate.
• It does not ask you to create an account, and it has no paid tier to upsell.
• It does not claim capabilities a browser does not have. A QR code cannot make a phone join a Wi-Fi network from a web page, and the Wi-Fi page says so instead of showing a button that does nothing.
• It does not present a crack-time estimate without stating the attack speed behind it — the same password is hours or centuries depending on whether the hash is bcrypt or unsalted MD5.

Known limits

Estimates are estimates. Password strength is scored as entropy under a stated character-set assumption; password reuse, phishing and a compromised mail account are outside what any strength meter can see. Random numbers from a browser CSPRNG are appropriate for games, raffles, sampling and test data, and are not a substitute for a hardware random source in cryptographic key generation.

The QR decoder handles the four standard encoding modes and the common payload formats — URL, Wi-Fi, vCard, MeCard, email, phone, SMS, geo and OTP. Unusual or malformed codes are shown as raw text rather than guessed at.

How to reach us

Corrections are welcome, especially on the guides: if a claim is out of date or an assumption is wrong, send the page and the correction to [email protected]. Pages carry a review date, and content is re-checked when a browser change affects it — BarcodeDetector support, in particular, has moved several times.