Password Generator
Strong passwords from your browser's crypto RNG. Never sent anywhere.
About the password generator
Passwords are generated in your browser using crypto.getRandomValues, the
same cryptographically secure source used to generate encryption keys. Nothing is
transmitted, logged or stored β reload the page and the password is gone for good. The
generator also guarantees at least one character from each set you have enabled, so a
password can't accidentally come out with no digits in it.
The passphrase button builds a memorable alternative from a curated word list, which is easier to type on a phone or read aloud than a random string.
What makes a password strong
The strength figure shown is calculated entropy β the size of the character set you chose raised to the length, expressed in bits. It measures how many guesses an attacker would need on average, and it is the only honest way to compare passwords.
Length matters far more than exotic characters. A 20-character lowercase-only password has about 94 bits of entropy; a 10-character password using every symbol on the keyboard has about 65. Adding one character multiplies the search space; adding one more symbol type barely moves it.
Rough guide: under 50 bits is weak, 60β80 is reasonable for ordinary accounts, and 80 or more is comfortably beyond brute force with any foreseeable hardware. Modern guidance from NIST also drops the old advice about forced complexity rules and periodic rotation, both of which pushed people into predictable patterns like Password1!.
Frequently asked questions
Are these passwords safe to use?
Yes. They are generated locally in your browser with a cryptographically secure random source, and never leave your device β there is no server involved. Reloading the page discards them permanently.
How long should a password be?
Aim for at least 16 characters for accounts that matter, and let a password manager handle remembering them. Length contributes far more to strength than adding unusual symbols does.
What is a passphrase and should I use one?
A passphrase is several random words joined together. It reaches good entropy while staying far easier to type on a phone or read aloud. It is an excellent choice for master passwords and device unlock codes.
Is it safe to generate passwords on a website?
It depends entirely on whether the generation happens locally. This one runs in your browser with no network calls, which you can confirm by opening your browser's network tools, or by disconnecting from the internet β it keeps working.
What do the entropy bits mean?
Bits of entropy measure how unpredictable the password is. Each extra bit doubles the number of guesses needed. 80 bits is roughly 1.2 septillion combinations, which is beyond brute force with current hardware.