How to use Password Generator
- 1Choose Random password or Passphrase at the top.
- 2For a password, set the length with the slider and pick uppercase, lowercase, numbers and symbols. Turn on Avoid look-alikes if you will type it by hand.
- 3For a passphrase, choose the number of words, a separator, and whether to capitalize words and add a number.
- 4Check the strength meter: it shows the entropy in bits and how long an attacker would need on average.
- 5Click Copy, or choose How many to generate up to 50 at once and use Copy all.
How the passwords are generated
Passwords are built with crypto.getRandomValues, the same cryptographically secure generator browsers use for encryption keys. Characters are chosen with rejection sampling, so every character in the pool is equally likely and there is no modulo bias. When you select several character sets, the generator makes sure each set appears at least once while keeping the result uniformly random among passwords that meet that rule.
Nothing is sent over the network and generated passwords are never stored. Only your settings (length, character sets, word count) are remembered in this browser so the page opens the way you left it.
Passphrases from the EFF word list
Passphrase mode picks words at random from the EFF Large Wordlist, 7,776 common English words chosen by the Electronic Frontier Foundation to be easy to spell and remember. Each word adds about 12.9 bits of entropy, so five words give roughly 64 bits and six words about 78 bits. A passphrase like Unharmed-Chivalry-Raisin8-Huskiness-Polish is far easier to type on a phone or TV than a string of symbols. The word list is loaded only when you open the passphrase tab. It is used under the CC BY 3.0 US license.
Reading the strength meter
Entropy is calculated from your settings, not guessed from the result, because a random password's strength comes from how many possibilities the generator could have produced. The crack time is the average time to find it by trying half of all possibilities: once for an offline attack at 10 billion guesses per second (a stolen, fast-hashed database) and once for an online attack limited to 100 guesses per second. Aim for at least 80 bits for important accounts, and use a password manager so every site gets its own password.
Frequently asked questions
Is it safe to generate a password on a website?
This page generates passwords locally with your browser's secure random generator and never transmits or stores them. You can load the page and then disconnect from the internet; it keeps working.
How long should my password be?
For a random password using all four character sets, 16 characters gives about 100 bits of entropy, which is beyond any practical attack. For passphrases, use at least 5 words, or 6 for very sensitive accounts.
What does Avoid look-alikes do?
It removes characters that are easy to confuse when reading or typing, such as I, l, 1, O, 0, o, S and 5. The strength meter accounts for the smaller character pool.
Are passphrases as secure as random passwords?
Yes, if they are long enough. Strength depends on entropy, and a 6-word passphrase from a 7,776-word list has about 78 bits, similar to a 13-character random password with all character sets.
Can I generate many passwords at once?
Yes. Set How many to 5, 10, 20 or 50, then copy them one by one or use Copy all to get one per line.