Password Generator

Generate strong passwords and passphrases with rules you control — and see how strong they actually are.

Runs on your deviceSecurity & PrivacyWorkingNo account needed

What this tool does

This tool draws randomness from crypto.getRandomValues, the browser's interface to the operating system's cryptographic random source. That distinction matters: Math.random is fast but predictable enough that generated secrets can be reconstructed, so it is never used here.

Every result is reported with its entropy in bits, calculated from the size of the character pool and the length you chose rather than from a scoring heuristic. Entropy is the honest measure of how much guessing an attacker must do; a password with 80 bits is genuinely out of reach of offline cracking, whatever a coloured strength meter might say about it.

Passphrase mode assembles words from a list instead of characters. The built-in list holds 1,289 short, unambiguous English words, and you can paste your own list into the input box to draw from that instead — at least 64 words, or the tool refuses rather than quietly handing you something weak. The result is longer but far easier to type on a phone or read aloud, and its entropy comes from the number of words and the size of the list, not from substituting a 3 for an E.

How to use it

  1. Choose password or passphrase. Random characters are the most compact for a given strength. Passphrases are easier to type and remember, at the cost of length.
  2. Set length and character sets. Length runs from 6 to 128 characters, passphrases from 3 to 12 words, and up to 100 results per run. Longer beats more exotic: adding four characters raises strength further than adding a symbol set does.
  3. Generate and copy. Several are produced at once so you can pick one you can actually type. Paste it straight into your password manager.

Processing & privacy

Runs on your device. Your file is processed directly in this browser.

Common use cases

A new account

Generate one unique password per site so a breach at one service cannot be replayed against the others.

A password you must type

Passphrase mode, or excluding ambiguous characters, gives something you can enter on a TV remote or read over the phone.

Service credentials

Long random strings for database users and service accounts, where nobody needs to memorise anything.

Rotating after a breach

Generate replacements in bulk when a provider tells you to change everything.

Questions

Are these passwords sent anywhere?
No. Generation happens in this tab and results are never transmitted or stored. Closing the page discards them, which is also why you should paste one into your password manager before navigating away.
How much entropy do I need?
Roughly: 60 bits resists casual offline attack, 80 bits is comfortable for important accounts, and 100+ bits is beyond foreseeable brute force. The figure shown assumes an attacker knows your exact settings, which is the conservative assumption.
Are passphrases really as strong as passwords?
They can be, but they need length. With the built-in 1,289-word list each word is worth about 10.3 bits, so four words is roughly 41 bits — weaker than it looks — and six words about 62. The figure shown is computed from the list you actually used.
Why exclude ambiguous characters?
Because characters like l, I, 1, O, 0 and o are easy to confuse when a password is read from a screen or written down. The exclusion is broader than that: it also drops the bracket, slash, quote and punctuation symbols that are awkward to dictate. The displayed entropy is calculated from the reduced pool, so it already accounts for the loss.
Should I use this instead of my password manager's generator?
Either is fine — both draw on cryptographic randomness. Use your manager's when you are already in it; use this when you want to see the entropy, or need a passphrase in a particular shape.
What can this tool not do?
It cannot check a result against breach corpora, score an existing password, or remember what it generated — there is no history, so a result you did not copy is gone. The entropy figure is also a slight over-estimate when 'require at least one character from every set' is on, because that filter narrows the set of possible passwords; the effect is a fraction of a bit at normal lengths.

Related tools

  • Protect PDF — Add a password and set permissions on a PDF.
  • Sign PDF — Draw, type or upload a signature and place it on the page.
  • Hash Generator — Compute MD5, SHA-1, SHA-256 and SHA-512 digests.
  • Redact PDF — Permanently remove sensitive content, not just cover it.
  • Remove PDF Metadata — Strip identifying metadata before you share a file.
  • Remove EXIF — Strip camera and editing metadata from photos.