Essential cookies only — Cookie Policy.

About Trusty Password

Anti-phishing credential guidance for individuals, teams, and organisations. Written by a practitioner with direct experience in security awareness training.

Mission

Phishing and credential stuffing together cause the majority of account takeovers. Both are preventable with two complementary habits: unique generated passwords, and verification before entering credentials anywhere. This site teaches both simultaneously.

Trusty Password was built around an observation from years of security awareness work: most advice tells people what not to do but not how to verify the alternative. "Don't click links" is good advice — "here are the 5 specific things to check before entering credentials anywhere" is useful guidance.

The Phishing-Aware Credential Guard combines a strong password generator with a live verification checklist — so users generate a good password and develop the habit of using it on the right site.

About the Author

AY Tanoli is a hobbyist with a keen interest in password security and online safety who studies phishing prevention, credential protection, and online safety. This site is a collection of that research — written in plain language for individuals and organisations who want to understand and protect against phishing threats without the technical jargon. Keen on educating and helping others stay safe online.

Keen on educating and helping individuals and organisations recognise and avoid phishing threats through clear, actionable guidance.

Expertise areas

  • Phishing and spear phishing awareness training
  • Fake login page detection and URL verification
  • FIDO2/WebAuthn phishing-resistant MFA — design and advocacy
  • Credential stuffing and password hygiene
  • Incident response training for credential compromise
  • NCSC Active Cyber Defence, CISA Phishing-Resistant MFA, NIST SP 800-63B

Trust Signals

✅NCSC & CISA aligned

All guidance follows NCSC phishing guidance and CISA phishing-resistant MFA recommendations.

🔒Client-side CSPRNG

All generation uses crypto.getRandomValues(). Zero transmission. No passwords stored.

📊Primary sources only

Claims cite NCSC, CISA, NIST SP 800-63B, Verizon DBIR, or academic research.

🇬🇧UK operated

Kokal Operations Ltd, England & Wales. UK GDPR compliant.

Editorial Standards

All claims cite primary sources: NCSC, CISA, NIST SP 800-63B 2025, Verizon DBIR, and peer-reviewed security research. The Am I Safe? protocol and MFA comparison table are derived from NCSC login verification guidance and CISA's Implementing Phishing-Resistant MFA factsheet. This site does not constitute professional security advice for your specific organisation's environment.

Organisation Details

Operated by: Kokal Operations Ltd, England and Wales
Website: trustypassword.com
Founded: 2026
Contact: hello@trustypassword.com
Report phishing: phishing@trustypassword.com
Privacy: Privacy Policy (UK GDPR compliant)