Yes, Geslar is completely free for personal use — no limits, no subscription, no hidden costs. The password generator, password manager and TOTP authenticator are all available at no charge.

Do I need to register to use Geslar?

No. Geslar requires no registration, email or user account. Install the extension, set a master password and start using it immediately. Your data never leaves your device.

How secure is Geslar?

Geslar uses AES-256-GCM encryption with PBKDF2 key derivation (600,000 iterations) — the same standard used in military and banking systems. The master key stays only in RAM and is never written to disk. Zero-knowledge architecture means even Geslar cannot access your data.

What are passphrases and why are they more secure?

Passphrases are passwords made of real words (e.g. 'meadow-cloud-chocolate-chestnut'). They are longer than traditional passwords, easier to remember and exponentially harder to crack. Geslar generates passphrases from 4 Croatian dictionaries, including Kajkavian and Chakavian dialects.

Can I import passwords from another password manager?

Yes, Geslar supports import from 12 popular password managers and browsers: Bitwarden, 1Password, LastPass, KeePass, Chrome, Firefox, Edge, Safari and more. Simply export a file from your old manager and load it into Geslar.

Geslar — Free Secure Password & Passphrase Generator

Password breach check

Enter a password to check. The password never leaves your device — k-Anonymity protocol is used, sending only the first 5 of 40 characters of the SHA-1 hash.

How does the check work?

The password is SHA-1 hashed locally on your device
Only the first 5 of 40 characters of the hash are sent to the server
The server returns all hashes starting with that prefix (~500 results)
Comparison is done locally — the server never learns your password

Database: HaveIBeenPwned Passwords · Troy Hunt

Email breach check

Check if your email address has been found in known data breaches. The check is performed on the official HaveIBeenPwned website.

Why an external site? Email checking requires sending the full address to a server — this is not compatible with Geslar's privacy philosophy. Unlike password checking (where only a partial hash is sent), email checking does not support k-anonymity. That's why we redirect you to the official HaveIBeenPwned website where you can check yourself.

What to do if your email is compromised?

Change the password on every service affected by the breach
Use a unique password for each service — Geslar generates them automatically
Enable two-factor authentication (2FA) wherever available
Check if you've received suspicious messages — phishing attacks often follow breaches

Take control of your passwords

Chrome Geslar Škrinjar Firefox Geslar Škrinjar Edge Geslar Škrinjar

Why install the extension?

Škrinjar: save passwords

Locally encrypted vault for passwords, cards, notes and TOTP codes. AES-256-GCM encryption.

Autofill: one click

Automatically fills login forms. Remembers new passwords, offers strong password generation during registration.

TOTP: built-in authenticator

Two-factor authentication built into the password manager. Copies 2FA code automatically on login.

Sync: synchronization (coming soon)

Access passwords on all devices. End-to-end encrypted — even we cannot read your data.

Secure passwords & passphrases in Croatian