How to use Password generator
- Choose random characters or a passphrase of words.
- Set the length or number of words, and which characters to include.
- Select Generate and copy the result into your password manager.
What makes a password strong
Strength comes from unpredictability, measured in bits of entropy: each extra bit doubles the number of guesses an attacker needs. A random password drawn from all 94 printable characters gains about 6.5 bits per character, so 20 characters give around 130 bits, far beyond any practical attack. Length helps more than adding symbols, and real randomness matters most of all.
That randomness is where many generators fall short. This one draws every character from crypto.getRandomValues, the browser's cryptographic random number generator, and uses rejection sampling so each character is exactly as likely as any other. Generators built on Math.random, or that take a random number modulo the alphabet size, are slightly predictable.
Passphrases
A passphrase strings together random words, such as Acid-Zoom-Grape-Trunk-Mango-Elbow-42. Words come from the Electronic Frontier Foundation's short wordlist of 1,296 common words chosen to be easy to type and hard to confuse, so each word adds about 10.3 bits. Six words and a number give around 69 bits, roughly as strong as an 11-character random password and much easier to type on a phone or say aloud.
Using what you generate
Use a different password for every account and keep them in a password manager, so a breach at one site doesn't unlock the others. A long passphrase suits the few passwords you have to type yourself, such as the password manager's own master password and your computer login.
Passwords are generated in your browser and exist only on this page until you copy them. Nothing is sent or saved.
Settings explained
Avoid look-alikes leaves out characters that are easy to misread, such as 0 and O or 1, l and I, which helps when a password will be read aloud or typed from paper; it costs a little strength, so add a character or two. Every chosen kind of character is guaranteed to appear at least once, for sites that insist on it, without making the password predictable.
Questions
- Is it really random?
- Yes. Every character comes from crypto.getRandomValues, the browser's cryptographic random generator, with rejection sampling so no character is more likely than another. Tools that use Math.random or a simple remainder are slightly predictable.
- Password or passphrase?
- A 20-character random password is very strong but hard to type. A six-word passphrase such as Acid-Zoom-Grape-Trunk-Mango-Elbow-42 is roughly as strong as an 11-character random one and much easier to type and remember.
- Is the password sent or saved anywhere?
- No. It's generated in your browser and exists only on this page until you copy it.