Password generator — strong and private
This tool generates a random password or a memorable passphrase entirely in your browser. It is for anyone creating a new account, rotating a compromised credential, or seeding a password manager who wants real randomness rather than a guessable pattern. Nothing is uploaded — even a generated password you choose not to use never leaves your device.
Why the randomness source matters
Most online password generators use Math.random(), which is a pseudo-random number generator — deterministic given its seed, and not designed for security. This tool uses the browser’s built-in crypto.getRandomValues API, the same cryptographically secure source used by cryptographic libraries and browser security infrastructure. The randomness is non-deterministic and cannot be predicted from earlier outputs.
Password mode
Set the length (6–64 characters) and choose which character sets to include:
- Uppercase: A–Z (26 characters)
- Lowercase: a–z (26 characters)
- Digits: 0–9 (10 characters)
- Symbols:
!@#$%^&*()_+-=[]{}|;:,.<>?(approximately 32 characters)
The generator guarantees at least one character from each selected set, then fills the remaining length randomly from the combined pool and shuffles the result. This ensures every chosen rule is always satisfied, not just on average.
The exclude ambiguous characters option removes 0 (zero), O (capital-oh), 1 (one), l (lowercase-L), and I (capital-i) — characters that look similar in many fonts and are easily misread when writing down or reading aloud a password.
Passphrase mode
Passphrases pick 3–8 random words from a built-in 256-word English word list and join them with a separator you choose (hyphen, underscore, space, or no separator). A four-word passphrase from a 256-word list has 256⁴ = approximately 4.3 billion combinations and is much easier to type on a mobile keyboard than a dense random-character string of the same entropy.
Adding a fifth word multiplies combinations by 256, pushing well past practical brute-force limits with current hardware.
Strength guidance
| Option | Entropy estimate | Use case |
|---|---|---|
| 12 random characters, mixed | ~79 bits | Minimum for everyday accounts |
| 16 random characters, mixed | ~105 bits | Important accounts, banking |
| 4-word passphrase | ~32 bits | Moderate (best with a manager) |
| 6-word passphrase | ~48 bits | Strong and easy to memorise |
| 8-word passphrase | ~64 bits | Very strong, memorable |
The entropy estimate assumes the attacker knows your generation method and pool size — this is the conservative and correct way to reason about password security.
When to use each mode
Password mode: when you will store the password in a password manager and never need to type it manually. Go long (20+ characters) and include all character sets.
Passphrase mode: when you need to type or remember the credential — master passwords for a password manager, full-disk encryption, or SSH keys. A passphrase of 5+ random words typed correctly beats a short complex password from a memorability standpoint while remaining genuinely strong.
All generation happens locally in your browser. Nothing is uploaded or stored.