Password Generator
Runs in your browser, nothing is uploaded. Your input is not saved.Generate strong random passwords or word passphrases using your browser’s cryptographic random generator.
About this tool
Passwords are built from your browser’s cryptographically secure random number generator, using rejection sampling so every character is equally likely. Each selected character type is guaranteed to appear, which keeps the result valid for sites with “must contain” rules. The entropy figure is length multiplied by the bits per character, so it is accurate for these random passwords and meaningless for ones a person invents. Passphrase mode picks words uniformly from the EFF large word list (7,776 words, about 12.9 bits per word), the same list used for Diceware. The EFF large word list is by the Electronic Frontier Foundation, licensed under CC BY 3.0 US.
Questions
Is the password sent anywhere or saved?
No. It is generated in your browser, kept only in the page’s memory, and never written to the URL, local storage, or a server.
How long should a password be?
For an account protected by a password manager, 16 to 20 random characters is plenty. Use longer values for encryption keys or anything that cannot be rate-limited.
Why not use Math.random?
Math.random is predictable and not designed for secrets. This tool uses crypto.getRandomValues, the browser’s cryptographic source.
Password or passphrase?
A passphrase such as “crane-velvet-orbit-mango-tundra-glide” is easier to type and remember, which suits a password manager’s master password or a disk-encryption key. Six words give about 77 bits, comparable to a 13-character random password. For accounts filled in by a password manager, a random password is shorter for the same strength.
Do capital letters and the number make a passphrase stronger?
Capitalising every word adds no strength, because an attacker can assume it. Adding a number adds a few bits (one random digit in a random word). Both exist mainly to satisfy sites that insist on capitals and digits. The strength figure counts them honestly.
Why exclude look-alike characters?
I, l, 1, O, 0, and o are easy to confuse when you read or type a password by hand. Excluding them costs very little strength at normal lengths.