Yes, Geslar is free for basic use — the password generator, password manager and TOTP authenticator are all available at no charge. Premium and Family add cloud sync and sharing.

Do I need to register to use Geslar?

No for basic use. Geslar requires no registration or account for local use — install the extension, set a master password and start right away. An account is only needed for cloud sync (Premium/Family). By default your data stays local on your device; with sync enabled it is encrypted before upload (E2E) — the server cannot see the contents.

How secure is Geslar?

Geslar uses AES-256-GCM encryption with PBKDF2 key derivation (600,000 iterations) — the same standard used in military and banking systems. The master key stays only in RAM and is never written to disk. Zero-knowledge architecture means even Geslar cannot access your data.

What are passphrases and why are they more secure?

Passphrases are passwords made of real words (e.g. 'meadow-cloud-chocolate-chestnut'). They are longer than traditional passwords, easier to remember and exponentially harder to crack. Geslar generates passphrases from 4 Croatian dictionaries, including Kajkavian and Chakavian dialects.

Can I import passwords from another password manager?

Yes, Geslar supports import from 12+ popular password managers and browsers. Simply export a file from your old manager and load it into Geslar — detailed per-source guides are in help.

Geslar — Free Secure Password & Passphrase Generator

Password breach check

Enter a password to check. The password never leaves your device — k-Anonymity protocol is used, sending only the first 5 of 40 characters of the SHA-1 hash.

How does the check work?

The password is SHA-1 hashed locally on your device
Only the first 5 of 40 characters of the hash are sent to the server
The server returns all hashes starting with that prefix (~500 results)
Comparison is done locally — the server never learns your password

Database: HaveIBeenPwned Passwords · Troy Hunt

Email breach check

Check if your email address has been found in known data breaches. The check is performed on the official HaveIBeenPwned website.

Why an external site? Email checking requires sending the full address to a server — this is not compatible with Geslar's privacy philosophy. Unlike password checking (where only a partial hash is sent), email checking does not support k-anonymity. That's why we redirect you to the official HaveIBeenPwned website where you can check yourself.

What to do if your email is compromised?

Change the password on every service affected by the breach
Use a unique password for each service — Geslar generates them automatically
Enable two-factor authentication (2FA) wherever available
Check if you've received suspicious messages — phishing attacks often follow breaches

Take control of your passwords

Chrome Geslar Škrinjar Firefox Geslar Škrinjar Edge Geslar Škrinjar

Why install the extension?

Škrinjar: save passwords

Locally encrypted vault for passwords, cards, notes and TOTP codes. AES-256-GCM encryption.

Autofill: one click

Automatically fills login forms. Remembers new passwords, offers strong password generation during registration.

TOTP: built-in authenticator

Two-factor authentication built into the password manager. Copies 2FA code automatically on login.

Sync: synchronization (with Premium)

Access passwords on all devices. End-to-end encrypted — even we cannot read your data.

Shared vault (Family)

Share selected entries with your family — up to 5 members, per-member permissions, E2E encryption.

Škrinjar on the web

Access your vault in the browser at my.geslar.app — no extension, same encryption.

Secure passwords & passphrases in Croatian