Password Generator
Random-character passwords or memorable passphrases, generated locally.
By opening this website or using its tools, you agree to our Terms and Privacy Policy.
very strong · ~103 bits of entropy
Your file never leaves your browser during processing
How it works
To generate a password, adjust the length and character types (or switch to passphrase mode) above — a new one is created instantly using your browser’s built-in random number generator, and it is never transmitted anywhere.
This tool uses `crypto.getRandomValues`, the Web Crypto API’s cryptographically secure random number source, rather than JavaScript’s ordinary `Math.random`, which is not designed to be unpredictable. Character selection also uses rejection sampling rather than a plain modulo, which matters more than it sounds: a naive `random() % charsetLength` very slightly favors low values whenever the charset size doesn’t divide evenly into the generator’s range, which is a real (if subtle) weakness in a password generator.
Passphrase mode strings together several unrelated words from a curated list instead of substituting characters in a single word. This is the same idea popularized by the "correct horse battery staple" style of password advice: a handful of random words is both easier to type and remember than a jumble of symbols, and can carry comparable entropy — five words from this tool’s list is roughly on par with a 9-character fully-random password.
The strength meter estimates entropy directly from what was actually selected — the character set size raised to the password length, or the word list size raised to the word count — not a canned "strong/weak" guess. Below 40 bits is crackable with consumer hardware in a reasonable time; 80 bits and up is not practically breakable today.
Nothing about this process touches the network. The counter below the generator monitors every network-capable browser API for the whole time you’re on this page and confirms it stays at zero.
FAQ
Is this password sent to a server or stored anywhere?
No. It is generated by your browser’s Web Crypto API and exists only in this page until you copy it or navigate away. The live network monitor on this page confirms nothing is sent.
Is Math.random() used anywhere in this tool?
No. All randomness comes from crypto.getRandomValues, the cryptographically secure generator browsers expose specifically for this kind of use.
Is a passphrase as strong as a random password?
It can be. Five words from this tool’s list carry about the same entropy as a 9-character fully-random password, and are considerably easier to type and remember. Add a couple more words to match a longer random password.
What does the strength meter actually measure?
Bits of entropy — log2 of the number of equally likely outcomes given your settings. It reflects only what you selected (length and character types, or word count), not any guess about how you’ll use the password.
Should I exclude ambiguous characters?
Only if you expect to read and retype the password by hand — it removes characters like 1, l, I, 0, and O that look alike in some fonts. If you’ll copy-paste it, leave it unchecked for slightly more entropy.