Security
Password Generator
Strong random passwords, memorable passphrases and PINs, generated with the browser’s cryptographic RNG. A live entropy meter tells you how strong the result actually is, and nothing ever touches the network.
Four steps
How to generate a strong password
- 1
Choose a type
Random password for a manager, passphrase for anything you must memorise, PIN for numeric locks.
- 2
Set the strength
Aim for 16+ characters or 5+ words, and watch the entropy meter reach at least 80 bits.
- 3
Filter the characters
Exclude look-alikes if you will ever read or retype the password by hand.
- 4
Copy and store it
Copy the result straight into your password manager — never into a note or an email.
Length is the lever that matters
The old advice about mixing uppercase, lowercase, digits and symbols produced passwords that were hard for humans and easy for computers. P@ssw0rd1! satisfies every complexity rule and is in every cracking dictionary. What actually defeats an offline attack is the size of the search space, and length grows that far faster than variety does.
| Recipe | Entropy | Verdict |
|---|---|---|
| 8 chars, letters + digits | ~41 bits | Weak |
| 12 chars, full pool | ~78 bits | Fair |
| 16 chars, full pool | ~104 bits | Strong |
| 4 random words | ~41 bits | Weak on its own |
| 5 random words | ~52 bits | Fair |
| 7 random words | ~73 bits | Strong and memorable |
Where passphrases earn their place
You should not be memorising more than about three passwords. Those three — your password manager’s master password, your device login and your disk encryption — are exactly where a passphrase belongs: long enough to be strong, structured enough to remember.
The critical detail is that the words must be randomly chosen. A phrase you invented yourself is drawn from a much smaller space than you think, because human word choice is heavily patterned. The generator here picks from roughly 1,300 words using the same CSPRNG as the password mode.
Rules worth following
- Never reuse a password. Breaches get combined and replayed automatically; one reused password turns a single leak into a chain of compromises.
- Use a password manager. It is the only realistic way to have a unique strong password everywhere.
- Turn on two-factor authentication. An app-based code or a hardware key beats SMS, which is vulnerable to SIM swapping.
- Protect the email account first. Anyone with your email can reset almost everything else.
- Stop rotating passwords on a schedule. Modern guidance from NIST is to change a password when there is evidence of compromise, not every ninety days — forced rotation pushes people towards predictable variations.
Handling the output safely
Copy the password straight into the field or manager that needs it. Do not paste it into a note, a chat message or an email to yourself — those are all far weaker containers than the password itself. Reloading this page discards everything it generated, which is the intended behaviour.
Related tools
The random number generator uses the same secure source for numbers and dice, the case converter handles text formatting, and the word counter covers text statistics. All of them run entirely in your browser.
Answers
Frequently asked questions
crypto.getRandomValues(), the browser’s cryptographically secure random number generator — the same source used for TLS key material. We also reject values that would introduce modulo bias, so every character in the pool is equally likely rather than merely close to it.l, I, 1, O and 0 are indistinguishable in many fonts. If you will ever read the password aloud, copy it off a screen or write it down, excluding them prevents a class of extremely annoying failures. Leave them in if the password only ever moves by copy and paste.