Geslar
About the app
Generator, password manager and authenticator — all in Croatian, all free.
About the name
Geslar
geslo
archaic term
password, passphrase, motto — nearly displaced by the modern "lozinka" in everyday speech
+
-ar
suffix
maker, one who deals with something — like kovač (smith), lozar (vintner), ključar (locksmith)
=
geslar
neologism
master geslar — one who creates and sends passwords
Mission
01
Security without compromise
AES-256-GCM encryption, zero-knowledge architecture, local storage. Security features will never be behind a paywall.
02
Croatian language as the foundation
The only password manager with a Croatian passphrase generator — 5,700+ words, 8 dialects, 1,500+ metaphors. Interface, documentation and support in the native language.
03
Transparency
No analytics, no cookies, no tracking. Geslar doesn't know who uses it — nor does it care. Privacy is not a marketing phrase, but an architectural decision.
Features
Phrase generator
Passphrase passwords from random Croatian words (5,700+ in database) — easy to remember, cryptographically strong.
Password generator
Random passwords in four levels: Basic (8–12) to Maximum (21–32 characters).
More
Length is randomly chosen within the range of each level. Guaranteed presence of selected character sets — uppercase, number and special character if enabled.
Customizable settings
Uppercase, numbers and special characters; for phrases complexity and separator, for passwords strength level.
Multiple separators
Dash, underscore, dot, space or none — multiple can be selected, applied randomly between each word.
Bulk generation
Up to 20 phrases or passwords at once, each with copy, description and QR code options.
Account type recommendations
Guide with recommended minimum strength for each account type — available on the Security & tips page.
Data breach checking
Check if a password is in the HaveIBeenPwned database — processed locally, never leaves the device.
QR code
QR code of the generated password for quick transfer by scanning — also available for each password in the bulk list.
Accessibility panel
Theme, font size, high contrast and reduced motion — all settings are remembered between visits.
PWA support
Install on device and use without an internet connection.
Keyboard shortcuts
All key actions available from the keyboard — no mouse needed.
Show shortcuts
Enter generate · C copy · L send · 1 Phrases · 2 Passwords · 3 Message · ? help · Esc close
Password description
Optional description (e.g. "Gmail", "VPN") displayed in the QR code, when sending and on the receive page.
Password sharing
Direct sharing via Web Share API — AirDrop, messages, email and other device methods.
Secure message
Send an encrypted text message (up to 4,000 characters) as a secure link — zero knowledge, equally secure as sending a password.
More
Message tab (shortcut 3) — enter text, click Generate secure link. Recipient sees the message on the receive page with one-click copy. All the same options as for passwords: expiry, view limit, PIN, one-time link.
Secure Send
AES-256-GCM encryption locally — key stays exclusively in the link, server never sees it (zero-knowledge).
More
The ciphertext is stored on the server, the key stays in the URL fragment (#) which the server never receives. Changing any option automatically regenerates the link without re-clicking.
Secure link options
Expiry period, view limit, one-time link, confirmation step and PIN protection — combine as needed.
More
Expiry (1–90 days) · Max views (1–99) · One-time link — deleted immediately after first view · Confirmation step — recipient must click a button, prevents bots from consuming views · PIN protection (4–8 digits, PBKDF2, never leaves the device)
QR code for secure link
QR code for the generated secure link — the recipient just needs to scan, no URL typing needed.
View limit and one-time link
Set a maximum number of views or enable a one-time link that is deleted immediately after the first opening.
Receive page
Dedicated page for displaying the received password with copy and automatic clipboard clearing.
More
Supports one or more passwords with descriptions, display of remaining view count. In case of error or expired links, shows a clear return to the Home page.
Dialect dictionaries
8 dialect dictionaries (Chakavian, Dalmatian, Dubrovnik, Istrian, Kajkavian, Medjimurje, Slavonian, Zagorje) plus standard (5,700+ words). Each dictionary can be independently enabled in Settings.
Metaphors
Generate passphrases from 1,500+ Croatian idioms, phrases and poetic expressions. Selected in Settings → Dictionaries → Metaphors — exclusively with dialect dictionaries.
How to use
Type: Phrases, Passwords or Message
At the top select Phrases (memorable combinations), Passwords (random strings) or Message (encrypted text message); shortcuts 1, 2, 3.
Password check
The Check password tab uses HaveIBeenPwned — only 5 characters of the SHA-1 hash are sent, the password never leaves the device.
Generate button
Click or press Enter; with the − 1 + button for result count (1–20) and Settings for advanced options.
Copy, QR and Send
Copy saves to clipboard and auto-clears in 60s, QR generates a scanning code, Send sends via encrypted link.
Generator settings
Settings button opens options: uppercase, numbers, special characters, Croatian letters; for phrases separator and Word count (2–6); for passwords strength level.
Croatian letters
Settings › s→š (phrases) or šđčćž (passwords). Enable to display Croatian letters (š, đ, č, ć, ž) in phrases and passwords. When disabled, ASCII equivalents are used (s, d, c, z). In Settings › Dictionaries you can select active dialect dictionaries.
Secure Send — options
In the Send dialog set expiry, view limit, one-time link, confirmation step and/or PIN, then generate the link.
More
AES-256-GCM encryption locally — key stays exclusively in the link, server never sees it. Confirmation step prevents bots and automatic previews from consuming views. PIN (4–8 digits) — recipient must enter the PIN, PIN never leaves the device. Each option change automatically regenerates the link.
Secure Send — link sharing
Copy the link, share via Web Share API or display as QR for scanning — summary of active options always visible.
Secure message — sending
Click the Message tab (or shortcut 3), enter text and click Generate secure link. Send the link to the recipient — the message is displayed and can be copied with one click.
Accessibility
Aa button in the header — theme, font size, high contrast and reduced motion; all remembered for the next visit.
Geslar for business
Geslar Škrinjar is a password manager that delivers what competitors charge for or don't offer at all — free, local and with stronger encryption. With planned team features, Geslar becomes a complete password management solution for business environments.
Why Geslar instead of Bitwarden, 1Password or LastPass
Stronger encryption
AES-256-GCM with data integrity verification. Bitwarden and LastPass still use the older CBC mode — if someone modifies your data, they can't detect it. Geslar can.
Free — no paywall
TOTP 2FA keys, Škrinjar health check and secure password sharing — all free. Bitwarden charges $10/year for TOTP, 1Password asks $8/month per user, LastPass limits to 1 device.
Local — no mandatory cloud
Passwords live on the employee's device. Bitwarden, 1Password and Proton Pass require cloud from day one. Geslar works fully offline — sync will be an option, never a requirement.
Zero employee tracking
No analytics, cookies, telemetry or user accounts. Competitors collect usage data, login activity and device information. Geslar doesn't know who uses it — nor does it care.
Invisible auto-fill
Closed Shadow DOM with randomized element names — malicious pages cannot detect Geslar or read data. Most competitors use an unprotected overlay that pages can intercept.
Croatian phrase generator
The only one in the world — phrases from 5,700+ Croatian words and 8 dialects. Employees get memorable master passwords in their native language, cryptographically equally strong as random strings.
Team features — coming soon
Geslar Škrinjar is getting team features that enable secure password management within an organization. All planned features will be available without a subscription.
Shared vaults
Create shared vaults for teams — marketing, IT, management — each with its own access rights. End-to-end encrypted, server never sees the content.
Access control
Define who can read, edit or delete records in a shared vault. New employee onboarding: add them to the team and they immediately have access to everything they need.
Secure Send within the team
Already available today: encrypted links with PIN protection, one-time access and limited expiry — ideal for sharing service credentials during onboarding.
Team password health
Overview of all password health in the organization — how many are weak, reused, old or compromised. Without insight into the actual employee passwords.
Audit trail
Log of who accessed which record and when — for internal audits, ISO 27001 audit and NIS2 incident management requirements.
No infrastructure
PWA + browser extension. No server to maintain, no software to install, no IT approval needed. Works on any device with a browser.
Regulatory compliance
GDPR
Zero-knowledge architecture, no personal data collection, no cookies. Minimal processing in accordance with the minimization principle (Art. 5.1.c). Privacy policy →
ISO 27001
Aligned with Annex A controls: cryptographic keys (A.8.24), data protection (A.8.5), access management (A.8.9), information classification (A.5.12). Audit trail for audits.
NIS2 Directive
Art. 21 — encryption, secure authentication, supply chain protection (no external dependencies for critical functions), incident management and business continuity.
NIST SP 800-63B
Long phrases instead of forced complexity, no periodic rotation, password checking against 1.1+ billion known breaches via k-Anonymity protocol. More about security →
Geslar Škrinjar is available for free — install the extension and start using it right away. For team features — reach out via the contact form and be among the first to try them.
What's new
A complete list of all changes and improvements by version is available on the What's new page.
What's new →Take control of your passwords
Military-grade encryption, local, free with no limits.