How to use the password generator
- Choose Random password or Passphrase.
- For passwords, set the length (8 to 128) and character types. Optionally exclude look-alike characters and require at least one of each type.
- For passphrases, choose the number of words, a separator and capitalisation, and optionally add a digit.
- Check the entropy and strength, generate several at once if you like, and copy the one you want.
- Store it in a password manager. Do not reuse it across sites.
Worked example
20-character password and 5-word passphrase
A 20-character password using lowercase, uppercase, digits and the 28 symbols (90 characters in total) with at least one of each type has 129.7 bits of entropy. A 5-word Title Case passphrase with one added digit, drawn from the built-in list of 2,148 words, has 61.0 bits. A 6-word lowercase passphrase has 66.4 bits.
How it works
Random values come from crypto.getRandomValues(). Each character or word is chosen with rejection sampling: 32-bit values at or above the largest multiple of the alphabet size are discarded, so value mod n is exactly uniform (no modulo bias). With "at least one of each type", whole passwords are regenerated until the rule is met. Entropy is log2 of the number of equally likely outcomes; for required types it is counted exactly with inclusion-exclusion.
Assumptions
- Entropy figures assume an attacker knows exactly how the password was generated (character sets, length or word list) but not the random choices. This is the standard, conservative assumption.
Frequently asked questions
Are the passwords sent anywhere?
No. They are generated in your browser and never sent to our server, logged or stored. You can disconnect from the internet after the page loads and the tool still works.
How long should my password be?
For a random password, 16 or more characters with mixed types gives over 100 bits, which is far beyond practical guessing. For a passphrase, use at least 5 or 6 words. A password manager can remember them for you.
Are passphrases as secure as random passwords?
Per character, no, but they are easier to type and remember. Each word from this list adds about 11 bits, so 6 words give about 66 bits, and 8 words about 88 bits.
What does excluding look-alike characters do?
It removes I, l, 1, O, 0, o and |, which are easy to confuse when reading or typing a password by hand. It slightly reduces entropy, which the tool accounts for.
Limitations
- The strength label assumes offline guessing at 10 billion guesses per second; real attacks vary widely.
- Some sites limit length or allowed symbols. Adjust the options to match their rules.