Password generator
Make a strong random password or an easy-to-type passphrase. It is generated in your browser and never stored or sent anywhere.
Loading…
How this password generator works
Every character is picked with crypto.getRandomValues, the secure random source built into your browser, not Math.random. Picks are unbiased, so no character is more likely than another. The password is made and shown on your device. It is never stored, logged or sent, so there is nothing to leak.
How long should a password be?
Length matters more than fancy symbols. With all four character types, 16 characters gives about 98 bits of randomness, which is strong against any realistic attack. For a password manager master password, go to 20 or more. Use a unique password for every account.
Password or passphrase?
A passphrase strings together random words, like a dash-separated set of five. It is easier to type and remember, and five words from a 2048-word list give 55 bits. Use six or more for important accounts. Use a random password for anything a password manager fills in for you.
Questions
Is it safe to generate a password in a browser?
Yes, when it runs locally. This one does: the password is made on your device with the browser’s secure random generator and never sent anywhere. You can check the network tab, it stays empty.
Do you store or log the passwords?
No. Nothing is saved, not on a server and not in your browser. Close the tab and the password is gone, so copy it into your password manager first.
What is entropy, and what is a good number?
Entropy measures how unpredictable a password is, in bits. Each extra bit doubles the guesses needed. Aim for 80 or more for normal accounts and 100 or more for anything important.
How does the crack-time estimate work?
It assumes an attacker with a stolen password database guessing 10 billion times a second, and takes the average time to hit the right one. It is a rough guide, since real attackers vary and sites that limit guesses are much safer.
Why skip look-alike characters?
I, l, 1, O, 0 and o are easy to confuse when you read a password aloud or type it from paper. Skipping them makes it easier to copy by hand and costs very little strength.