Password Generator
Strong random passwords or easy-to-remember passphrases.
Using toolbook means you agree to our Terms and Privacy Policy.
very strong · ~103 bits of entropy
Your files stay on your device
How to use it
Choose a length and character types, or switch to a passphrase of random words. A strong password appears instantly, made on your device and never sent anywhere.
A new password appears as soon as the page loads. Make it longer, or choose which characters to include, and it updates instantly. Copy it, and you’re done.
Prefer something you can remember? Switch to passphrase mode for a few random words strung together, like “orbit-tulip-candle-ferry-moss”. Easier to type, and just as hard to guess when you use enough words.
The strength bar shows how hard your password would be to crack. Aim for the green zone. Typing it by hand? Tick “Exclude look-alike characters” so 1, l, and I don’t get mixed up.
Your password is made right here and never sent anywhere — not even to us.
FAQ
Is my password sent or saved anywhere?
No. It’s made on your device and disappears when you leave the page, unless you copy it.
Is a passphrase as strong as a random password?
It can be. Five random words are about as strong as 9 random characters, and much easier to remember. Add words to make it stronger.
What does the strength bar measure?
How many possible passwords your settings could produce — the more possibilities, the harder it is to guess.
Should I exclude look-alike characters?
Only if you’ll type the password by hand. If you’ll copy and paste it, leave them in.
How it worksFor the curious
Randomness comes from crypto.getRandomValues, the Web Crypto API’s cryptographically secure source, never Math.random. Characters are chosen with rejection sampling rather than a plain modulo, because random() % charsetLength slightly favours low values whenever the charset size does not divide the generator’s range evenly.
Passphrase mode draws unrelated words from a curated list — the “correct horse battery staple” idea. Five words from this list carry roughly the entropy of a 9-character fully random password.
The strength meter measures entropy directly from your settings: log2 of the number of equally likely outcomes (charset size to the power of length, or list size to the power of word count). Under 40 bits is crackable on consumer hardware in reasonable time; 80 bits and up is not practically breakable today.
Excluding ambiguous characters removes 1, l, I, 0, and O, which slightly reduces entropy.