The Password Generator creates strong, cryptographically-random passwords and human-friendly passphrases entirely in your browser. Pick a length, choose which character sets to include, and get 1–25 passwords at once. Passphrase mode uses a curated 512-word list to build memorable secrets like Coral-Ember-Falcon-Willow-42. Every character is drawn from crypto.getRandomValues with rejection sampling for a bias-free distribution.
What is a strong password?
A strong password has enough entropy — measured in bits — that guessing it is computationally infeasible. Entropy grows with both length and the size of the character set used. A 20-character password drawn from 90 possible characters carries roughly 130 bits of entropy, which is well beyond what current or foreseeable brute-force attacks can crack. This tool shows the entropy of every password it generates so you always know how strong it is.
How this generator works
- You pick a mode (password or passphrase), set the length or word count, and toggle the character sets you want.
- The tool builds an alphabet from your choices and draws each character using
crypto.getRandomValues— the browser's cryptographically-secure random source. - Rejection sampling is used to eliminate modulo bias, so every character in the alphabet has an exactly equal chance of being chosen.
- At least one character from each selected set is guaranteed to appear, then the result is shuffled with Fisher–Yates so required characters aren't clustered at the front.
Password vs passphrase — which should you use?
Passwords pack more entropy per character (up to 6.5 bits/char with symbols) but are harder to remember. Use them for anything stored in a password manager: online accounts, API keys, service credentials.
Passphrases pack less entropy per unit (~9 bits per word from a 512-word list) but are dramatically easier for humans to memorise. Use them for the handful of secrets you actually need to type: your master password, disk-encryption passphrase, or SSH key.
Why this tool runs 100% in your browser
A password that has been transmitted to a server is a password that could, in principle, be logged, cached, or intercepted. This tool never sends anything to any server: all generation happens in JavaScript that runs on your device, using the same random source your browser uses for TLS. You can verify it in your browser's network tab — regenerating a password produces zero network requests.
Best practices for using generated passwords
- Store generated passwords in a reputable password manager (1Password, Bitwarden, Apple Passwords) — never in a plain text file.
- Use a unique password per site. Reuse is the single biggest cause of credential-stuffing breaches.
- Enable multi-factor authentication (MFA) on every account that supports it — a strong password is a necessary but not sufficient defence.
- Rotate passwords when a service reports a breach, not on a fixed schedule.
- For anything you must memorise, use passphrase mode with at least 5 words.