About the Password Generator
A strong password is long and unpredictable. This generator creates passwords from random characters, or passphrases made of several random words that are easier to type and remember. Both are drawn with the cryptographically secure random number generator built into your browser (Web Crypto), not with Math.random.
Everything happens on your device. The passwords are never sent over the network and are not saved anywhere – once you close or reload the page they are gone, so copy the one you want into your password manager straight away.
How to use it
- Choose a mode: "Random characters" or "Passphrase".
- For random characters, set the length and tick the character types you want: uppercase, lowercase, numbers and symbols. Optionally exclude look-alike characters such as I, l, 1, O, 0 and o.
- For a passphrase, choose the number of words and a separator, and optionally capitalize the words or add a number.
- Set "How many" if you need several passwords at once.
- Check the strength shown under the result, then click Copy next to the password you want. Click Generate for a new set.
Features
- Secure randomness: Characters and words are picked with crypto.getRandomValues and rejection sampling, so every character or word is equally likely.
- Every character type included: Each selected type appears at least once, which satisfies the "must contain a number and a symbol" rules of many websites.
- Passphrases from the EFF wordlist: Passphrases use the 7,776-word EFF Large Wordlist, designed to contain distinct, easy-to-spell English words.
- Honest strength estimate: The strength is shown as entropy in bits, calculated from the options you chose rather than guessed from the result.
- Bulk generation: Create up to 50 passwords or passphrases at once and copy them individually or all together.
Examples
A new account password
Keep the defaults – 16 characters with all four character types – for about 105 bits of entropy, more than enough for an online account stored in a password manager.
A master password you type often
Switch to Passphrase with 6 words and spaces as separators. Something like "orbit maple tunnel quiet garden lamp" is far easier to type on a phone than random symbols and still gives about 78 bits.
Wi-Fi or device PINs
For a Wi-Fi key that guests read off a card, turn on "Exclude look-alike characters" so nobody confuses O with 0 or l with 1.
Limitations and notes
- The strength in bits assumes an attacker knows the options you chose but not the random choices. It is an estimate of guessing effort, not a guarantee.
- Some websites limit length or the symbols they accept. If a password is rejected, reduce the length or turn off symbols and generate again.
- Nothing is saved: generated passwords disappear when you leave or reload the page.
- Passphrase words are English only.
Frequently asked questions
Are the passwords sent to a server or stored?
No. They are generated by JavaScript running in your browser and are kept only in the page’s memory. Nothing is uploaded, logged or written to browser storage.
What is a passphrase?
A passphrase is a password made of several randomly chosen words. Because each word comes from a list of 7,776, five words give about 65 bits of entropy while staying easy to remember and type.
How long should my password be?
For accounts protected by a password manager, 16 or more random characters is a good default. For a password you need to remember, a passphrase of 5 to 7 words is a practical choice.
What does "exclude look-alike characters" do?
It removes I, l, 1, O, 0 and o from the character pool. This makes passwords easier to read and type by hand, at the cost of a slightly smaller pool, which the strength figure takes into account.
Where does the word list come from?
Passphrases use the EFF Large Wordlist by the Electronic Frontier Foundation, published under the Creative Commons Attribution 3.0 US licence.