Password Generator
Generate strong random passwords or memorable word passphrases in your browser. Free, nothing sent anywhere.
🔒 Generated locally with your browser's cryptographic RNG — never sent anywhere.
Create strong passwords or passphrases locally
In Password mode, choose the length and which character sets to include — lowercase, uppercase, numbers and symbols — and optionally exclude look-alike characters (I, l, 1, O, 0). In Passphrase mode, generate a memorable string of random words (like correct-horse-battery-staple) with your choice of separator. Both use your browser's cryptographic random generator, and a live strength estimate shows the entropy in bits. Nothing is ever sent to a server.
Length beats cleverness, and the number that says so
Entropy is length × log₂(pool size), and the page shows it in bits as you change the options.
The arithmetic is unforgiving in a useful way: adding symbols to a 12-character password takes the pool from 62
to 87 and buys about 6 bits, while making it 16 characters instead buys 24. Substitutions do worse than nothing
— P@ssw0rd! is a dictionary word with four predictable swaps, and every cracking tool tries those
first, so it is weaker than its length suggests rather than stronger. The bands here are 40, 70 and 110 bits:
under 40 is guessable by anyone who wants to, and over 110 is beyond brute force for any foreseeable
hardware.
Where the randomness comes from, and where the password should go
Characters are drawn from the browser's cryptographic random source, not from Math.random, which
is fast, predictable from its own output, and wrong for this. Nothing is generated on a server and nothing is
sent anywhere. The exclusions exist for real reasons rather than superstition: look-alikes
(Il1O0o|`) matter when a password will be read off a screen and typed by hand, and punctuation is
worth dropping when a system will eventually put the password through a shell, a CSV or an old form that has
opinions about quotes. A generated password you have to remember is the wrong tool — use a manager, and let the
one password you do memorise be a long passphrase rather than a short scramble.
Frequently asked questions
Are the passwords really random and safe?
Yes — they use the Web Crypto API (crypto.getRandomValues) with rejection sampling to avoid bias, the same secure randomness browsers use for cryptography, generated entirely on your device.
What is passphrase mode?
It joins several random words into a phrase that is easier to remember and type than a symbol soup, while staying strong. Add more words for higher entropy.
Is the password sent anywhere?
No. It is generated in your browser and never leaves your device — close the tab and it is gone.
How long should a password be?
Long enough to clear about 70 bits for anything that matters, which is roughly 12 characters from a mixed pool or 16 from letters alone. For a password protecting other passwords, aim past 110.
Are symbols better than more characters?
No. Going from 12 to 16 characters adds about four times the entropy that adding symbols to 12 does. Symbols help; length helps far more, and it is easier to type.
Why would I exclude look-alike characters?
Because I, l, 1, O, 0 and the pipe are hard to tell apart in many fonts. If a password will ever be read off a screen and typed by hand, or dictated, dropping them costs a little entropy and saves a lot of failed logins.