How to use the password generator
- Pick Random password or Passphrase. A fresh result is generated immediately.
- Adjust the length with the slider and switch character sets on or off, or choose how many words and which separator to use for a passphrase.
- Check the entropy in bits and the strength label; aim for 60 bits or more for accounts that matter.
- Click the copy button next to any password. Generate several at once if you need a batch.
Features
- Length from 4 to 128 characters with uppercase, lowercase, digit and symbol sets
- Exclude look-alike characters (0 O 1 l I) for passwords you may have to type or read aloud
- Passphrases of 4 to 8 random words from a curated 300+ word list, with your choice of separator
- Entropy in bits, a plain-language strength label and an estimated time to crack
- Unbiased sampling with crypto.getRandomValues and rejection sampling, never Math.random
- Generate up to 50 at once; copy each one individually
How strength is measured
Entropy is the number of bits an attacker has to guess. For a random password it equals length × log2(number of possible characters): a 16-character password from all 89 characters has about 104 bits. A passphrase of five words from a 400-word list has 5 × log2(400) ≈ 43 bits; add a sixth word and it jumps to about 52. The label and the crack-time estimate are derived purely from those numbers, assuming an offline attacker trying ten billion guesses per second, so the meter never flatters a weak password because it happens to contain a symbol.
Rough guidance: under 40 bits is weak, 40–60 is fair for low-value accounts, 60–80 is strong, and above 80 is more than any online service can brute-force. Whatever the number, a password is only as safe as the place it's stored, so use a password manager and never reuse one across sites.
Passwords or passphrases?
Random character strings are best for anything a password manager fills in for you. Passphrases (correct-horse-battery-staple style) trade some length for memorability and are the better choice for the few secrets you must type by hand, such as your manager's master password or a disk-encryption key. Six random words from this list give roughly the same strength as a 9-character fully random password while being far easier to remember.
Why the randomness matters
Math.random is not designed for secrets and can be predicted. This tool uses the browser's cryptographic generator and chooses characters with rejection sampling, which avoids the subtle bias introduced by the common “random number modulo alphabet size” shortcut. Every character in the pool is equally likely.