Password Generator

Runs in browser Security

Create secure passwords or passphrases using cryptographic randomness, exclude ambiguous characters, and see an entropy estimate — nothing is sent to a server.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

How to use Password Generator

  1. Choose "Random characters" or "Passphrase".
  2. Set the length (or number of words) and the character classes.
  3. Click Generate; use Regenerate for a fresh batch.
  4. Copy a password into your password manager.
  5. Switch to "Check my password" to score an existing password.

Password Generator features

  • Random passwords with selectable uppercase, lowercase, digits and symbols
  • Guarantees at least one character from every enabled class
  • Exclude ambiguous characters (0 O 1 l I |)
  • Passphrase mode with a curated word list, separators, capitalisation and a random number
  • Entropy in bits, strength label and estimated offline crack time
  • "Check my password" mode that scores an existing password locally
  • Generate up to 100 passwords at once

Password Generator example

Five 16-character passwords

Input:

Length: 16 · Upper, lower, digits, symbols

Output:

tgCP+Mz%_$ai*L?k
…
Strength: Very strong · Entropy: ~105 bits · Crack time: millions of years

Frequently asked questions about Password Generator

How strong should a password be?

Aim for at least 60–70 bits of entropy for online accounts and 90+ bits for encryption keys or password-manager master passwords. A 16-character random password with all classes has about 105 bits.

Are passphrases weaker than random characters?

Per character yes, per password no: each word from the built-in list adds about 7.9 bits, so a five-word passphrase (~40 bits) needs six or seven words to rival a strong random password, but it is far easier to remember and type.

What does "exclude ambiguous" do?

It removes characters that look alike in many fonts — 0/O, 1/l/I, | and quotes — which helps when a password must be read aloud or typed from paper.

How is entropy calculated?

log2(pool size) × length, assuming every character is chosen independently and uniformly, which is exactly how the generator works. The "Check my password" mode applies penalties for dictionary words, sequences and repetition.

Is the generated password stored anywhere?

No. Generation uses crypto.getRandomValues in your browser; nothing is transmitted or saved. Copy it straight into a password manager.

Technical notes

Characters are drawn with unbiased indices from crypto.getRandomValues and shuffled so the guaranteed class characters do not sit at fixed positions. Entropy is computed as length × log2(pool size); the crack-time estimate assumes an offline attacker trying 10 billion guesses per second and needing half the key space on average.