Password generator
Random passwords and word passphrases, with the strength shown in bits.
Result
Made in this browser. Never sent, never saved.
Assuming ten billion guesses a second and half the possibilities tried.
Options
Words come from the EFF long list: 7,776 English words, used for every language on this site.
1 to 100
Related tools
Make a password you have not used anywhere else. Set the length, pick the character sets, and a new one appears at once. Switch to passphrase mode for a string of real words, easier to type on a phone or read out loud. Every character comes from your browser's cryptographic random source, and the meter reports entropy in bits instead of a vague colour. Nothing leaves this page: a password never reaches the address bar, your history or local storage.
How to use
- Choose password mode for characters or passphrase mode for words.
- Drag the length slider, or type the number of characters or words beside it.
- Tick the character sets you need, and switch on "no ambiguous characters" for a password read off a screen.
- Raise the count to get several at once, then use Copy all.
- Press Generate, or Ctrl and Enter, for a fresh draw.
What it handles
- Characters come from crypto.getRandomValues with rejection sampling, so no character is more likely than another.
- A password holds at least one character from every set you ticked, and the bits shown account for that restriction.
- The no-ambiguous option drops l, 1, I, O, 0 and the vertical bar, for a password someone retypes from a screen.
- Passphrases use the EFF long list of 7,776 English words, so each word adds 12.9 bits: five words is about 65.
- Bulk mode makes up to 100 at once, each drawn separately, and Copy all puts them one per line.
- Length runs from 8 to 128 characters and passphrases from 3 to 12 words; anything outside is pulled to the limit.
FAQ
Is my password sent to a server?
No. It is built by the script already in the page, so nothing is uploaded and nothing is logged. A password is never written to the address bar, to your history or to local storage, which is why this tool has no share link. Only settings stay on this device.
Are the passwords really random?
They come from crypto.getRandomValues. Picking a character with a plain remainder would make some characters slightly more likely, so draws that land in the uneven remainder are discarded and redrawn. There is no fallback to Math.random: a browser without that source shows a message instead of a weak password.
What does the number of bits mean?
It is the entropy: every extra bit doubles the number of guesses an attacker needs. Sixteen characters from all four sets are worth about 100 bits, far beyond what an offline attack can search today. Bits are the honest measure, so the meter shows them beside the plain-language label.
How is the time to guess worked out?
It assumes an offline attack on a stolen password hash at ten billion guesses a second, and that half the possibilities are tried before the right one turns up. The real figure depends on how the site stored your password, so read it as a scale, not a promise.
Is a passphrase weaker than a password?
Not if it is long enough. Each word is drawn from 7,776 possibilities, worth 12.9 bits, so six words beat a random eight-character password by a wide margin and are far easier to type. Adding a digit or capitals barely changes the strength; adding a word changes it a lot.
Why are the passphrase words only English?
The tool uses the EFF long wordlist, built in English so that the words are easy to type and hard to confuse with each other. No list of the same quality exists for the other six languages here, so every language draws from the English one. Password mode is unaffected.
Updated