Verification
This page recomputes every test vector from SPEC.md in your own browser, with the same code this site uses. If they all pass, this build matches the specification.
The keys here are public test data. Never use them for a real account.
0/47 vectors passed
| Vector | Description | Result |
|---|---|---|
| v01 | default recipe, catalog match | - |
| v02 | alias resolves to the same id as above | - |
| v03 | full URL with path and query resolves the same | - |
| v04 | subdomain of a catalog domain | - |
| v05 | bare domain, catalog match | - |
| v06 | unknown domain falls back to the registrable label | - |
| v07 | URL with userinfo and port | - |
| v08 | Turkish e-commerce, catalog match | - |
| v09 | Turkish alias with diacritics | - |
| v10 | Turkish dotted capital I and S-cedilla | - |
| v11 | same name typed on an English keyboard | - |
| v12 | Turkish soft g and umlauts | - |
| v13 | mixed case and extra spaces collapse | - |
| v14 | NFKC: full-width characters fold to ASCII | - |
| v15 | German sharp s expands to ss | - |
| v16 | Polish and Czech diacritics | - |
| v17 | non-Latin script becomes dashes | - |
| v18 | emoji between words is dropped to a dash | - |
| v19 | key typed without dashes | - |
| v20 | key typed in lower case | - |
| v21 | key typed with spaces instead of dashes | - |
| v22 | key with O/I/L confusables that normalize into 0/1/1 | - |
| v23 | counter 2 after one refresh | - |
| v24 | counter 3 | - |
| v25 | counter 17, two-digit decimal | - |
| v26 | counter 1000 | - |
| v27 | email login | - |
| v28 | same email in mixed case normalizes identically | - |
| v29 | email with plus tag | - |
| v30 | Turkish login folds like a site id | - |
| v31 | login with a pipe, which is stripped | - |
| v32 | second account on the same site | - |
| v33 | minimum length | - |
| v34 | length 12 | - |
| v35 | length 16, no symbols (bank-style rule) | - |
| v36 | maximum length | - |
| v37 | letters only | - |
| v38 | lowercase and digits only | - |
| v39 | digits only, PIN style | - |
| v40 | symbols only, stress case | - |
| v41 | uppercase only | - |
| v42 | all-zero payload key | - |
| v43 | all-max payload key | - |
| v44 | all-max key, long recipe with login | - |
| v45 | 128-character site id, the maximum | - |
| v46 | long multi-word Turkish name | - |
| v47 | 120-character login | - |
The whole algorithm is written down in SPEC.md and ships with 47 test vectors. Both the web version and the Android version have to pass every one of them, which is how we know the two platforms produce bit-for-bit identical passwords from the same key.