Password Generator

Runs in browser Security

Create secure passwords or passphrases using cryptographic randomness, exclude ambiguous characters, and see an entropy estimate — nothing is sent to a server.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

What makes a password strong?

Strength comes from length and unpredictability, not from forced symbols: NIST SP 800-63B recommends allowing long passphrases, screening new passwords against lists of breached ones, rate-limiting attempts, and not forcing periodic changes. A generated 16+ character random password stored in a password manager beats any memorable pattern.

How to use Password Generator

  1. Choose "Random characters" or "Passphrase".
  2. Set the length (or number of words) and the character classes.
  3. Click Generate; use Regenerate for a fresh batch.
  4. Copy a password into your password manager.
  5. Switch to "Check my password" to score an existing password.

Password Generator features

  • Random passwords with selectable uppercase, lowercase, digits and symbols
  • Guarantees at least one character from every enabled class
  • Exclude ambiguous characters (0 O 1 l I |)
  • Passphrase mode with a curated word list, separators, capitalisation and a random number
  • Entropy in bits, strength label and estimated offline crack time
  • "Check my password" mode that scores an existing password locally
  • Generate up to 100 passwords at once

Password Generator example

Five 16-character passwords

Input:

Length: 16 · Upper, lower, digits, symbols

Output:

tgCP+Mz%_$ai*L?k
…
Strength: Very strong · Entropy: 103.9 bits (90-character pool) · Offline crack time: 30,004,054,585 millennia
The strength label follows the entropy: the default 4-word passphrase is Fair at 40.4 bits, a 16-character random password Very strong at 103.9 bits.

Entropy (bits)

Axis from 0 to 110
  • < 28Very weak
  • 28–39.9Weak
  • 40–59.9Fair
  • 60–89.9Strong
  • ≥ 90Very strong
  • 60–70Minimum target for online accounts
  • 90+Target for keys and master passwords
  1. 140.4 Four words + numberPassphrase, the default · Strength: Fair
  2. 263.4 Eight words, no numberPassphrase · Strength: Strong
  3. 365 Seven words + numberPassphrase · Strength: Strong
  4. 4103.9 Random characters, length 16All classes, 90-character pool · Strength: Very strong

Values are what the generator reports for random choices; the tool warns below 60 bits. “Check my password” also lowers the score for dictionary words, sequences and repetition.

Frequently asked questions about Password Generator

How strong should a password be?

Aim for at least 60–70 bits of entropy for online accounts and 90+ bits for encryption keys or password-manager master passwords. A 16-character random password with all classes has about 104 bits.

Are passphrases weaker than random characters?

Per character, yes; per password, it depends on the number of words. Each word from the built-in 244-word list adds about 7.9 bits and the optional number about 9 more, so five words give about 40 bits (about 49 with the number) and reaching 60 bits takes 7 words with the number or 8 without. Matching the ~104 bits of a 16-character random password would take about 13 words. The advantage of a passphrase is that it is far easier to remember and type, not that it packs more entropy.

What does "exclude ambiguous" do?

It removes characters that look alike in many fonts — 0/O, 1/l/I, | and quotes — which helps when a password must be read aloud or typed from paper.

How is entropy calculated?

log2(pool size) × length, assuming every character is chosen independently and uniformly from the pool. The generator does that, except that by default it first places one character from each enabled class, so the figure is a slight overestimate. The "Check my password" mode applies penalties for dictionary words, sequences and repetition.

Is the generated password stored anywhere?

No. Generation uses crypto.getRandomValues in your browser; nothing is transmitted or saved. Copy it straight into a password manager.

Technical notes

Characters are drawn with unbiased indices from crypto.getRandomValues and shuffled so the guaranteed class characters do not sit at fixed positions. Entropy is computed as length × log2(pool size); the crack-time estimate assumes an offline attacker trying 10 billion guesses per second and needing half the key space on average.

References