Password Generator
Every password and passphrase here is drawn in this tab by your browser's own cryptographic generator, from a pool you can see: the readout names the number of characters or words it drew from and prints the entropy in bits that follows from it, so the strength is a measurement rather than a coloured bar. Lengths run from 4 to 128 characters with any mix of the four character sets, and the passphrase side draws from a bundled list of 2,048 common English words, which is exactly 11 bits a word. The result never leaves the device: it is not uploaded, not logged, not put in an analytics event and never written into a link, and the only thing this page remembers between visits is your settings.
Ready
Drawn in this tab the moment the page is ready
The length box takes any number from 4 to 128, so an 8, a 12 or a 16 character rule is one keystroke away. Turning a set off drops it from the pool and lowers the entropy shown; excluding look-alikes removes 6 characters (0 O 1 l I |) for a password you have to read off a screen and type somewhere else.
Made here, kept here. Every character is drawn from crypto.getRandomValues on your own device by rejection sampling, so no position in the alphabet is favoured. The result is not sent anywhere, does not enter an analytics event and is never written into a link, and the only thing this page remembers between visits is your settings. It cannot know the rules a particular site enforces, so check its length limit and which symbols it accepts before you save one.
Accuracy. Passwords and passphrases come from the browser's own cryptographic randomness, made on your device and never sent anywhere. The strength shown is the real entropy of the choices you made. It cannot know a site's own password rules.
Common questions
- Is it actually random?
- Yes, and from the strongest source a browser has. Each character is drawn from crypto.getRandomValues, the browser's cryptographic random number generator, and the draw is mapped onto the alphabet by rejection sampling rather than by a remainder. That distinction matters: 2 to the power 32 is not a multiple of 94, so taking the remainder would hand the first few characters of the alphabet one extra chance each. Draws that land above the last whole multiple are thrown away and taken again instead, so every character in the pool has exactly the same chance in every position. There is no seed, no pattern and no server involved, and nothing here uses the ordinary pseudo-random function that most pages reach for.
- What does the entropy number mean?
- It is the base-2 logarithm of how many different results your current settings can produce, which is the honest way to say how hard the password is to guess. Twelve lower case letters is 12 times log2(26), about 56 bits. Twelve characters from all four sets is about 78 bits. Sixteen characters from all four sets is about 105 bits, and a four word passphrase from the 2,048 word list is exactly 44 bits, because 2,048 is 2 to the power 11 and every word is 11 bits. One detail is worth knowing: when you ask for more than one character set, the tool guarantees at least one character from each, which removes some possibilities, so the figure shown is slightly below the plain length times pool calculation. It is the size of the space the draw actually comes from, not a flattering round number.
- Are the passwords stored or sent anywhere?
- No. Everything happens in the page you are looking at: there is no upload, no account and no server that ever sees a generated value. The value is not put into an analytics event and is never written into the address bar, so it cannot leak through a shared link or a browser history entry. This page does remember your settings in this browser, and only your settings: the record it saves is rebuilt field by field from a fixed list of options, so no generated value can reach storage even by accident. The last few values are listed under the tool so you can go back one if you copied the wrong thing, and they are held in the page itself and are gone as soon as you reload or close the tab.
- How long should a password be?
- Long enough that guessing it is not worth anyone's time, which today means about 12 characters with several character sets on, and 16 if it protects something that matters. This tool labels anything under 40 bits weak, 40 to 59 fair, 60 to 79 strong and 80 or more very strong, thresholds set by what an attacker with a stolen password file can grind through offline rather than by what a login form allows. Past 80 bits more length buys nothing an attacker can measure, so the practical answer is 16 characters or a six word passphrase, each of them different from every other password you use.
- What is a passphrase, and is it weaker?
- A passphrase is several whole words joined by a separator, like snug-lantern-mosaic-thunder. It is easier to type on a phone or a games console and easier to read off a screen, and its strength comes from the number of words rather than from odd punctuation. Each word here is drawn from a bundled list of 2,048 English words, so each is worth 11 bits: three words are 33 bits, four are 44, six are 66 and eight are 88. Capitalising the words adds nothing to the strength, because it is a fixed rule rather than a random choice, and the tool says so by leaving the entropy figure unchanged; adding a random digit at the end adds about 3.3 bits. If a passphrase is protecting something that matters, use six words or more.
- A site rejected the password. What now?
- That is the one thing this page cannot know, because password rules are set by each site and are not published anywhere a browser can read. Two switches usually fix it. Turn the symbols set off if the site rejects punctuation, or lower the length if it caps at 12 or 16 characters, both of which are named in the readout so you can see what the change costs in bits. If you have to read the password off the screen and type it somewhere else, such as into a television or a games console, switch look-alikes to Exclude: that drops zero and capital O, one and lower case L and capital I, and the pipe, taking the pool from 94 characters to 88.
Passwords and passphrases come from the browser's own cryptographic randomness, made on your device and never sent anywhere. The strength shown is the real entropy of the choices you made. It cannot know a site's own password rules.