Password Generator
Passwords are created on your device with the browser's cryptographic random generator. They are never sent, stored or logged.
Your password
Options
How strong is my password?
Strength is measured in bits of entropy: the number of equally likely passwords the generator could have produced, written as a power of two. Each extra bit doubles the work for an attacker. The crack time assumes an offline attacker trying 10 billion guesses per second and finding the password after searching half of the possibilities. Aim for 60 bits or more for accounts, and 80 or more for anything that protects other secrets, such as a password manager.
How are the passwords generated?
Random bytes come from your browser's crypto.getRandomValues, a cryptographically secure generator. Our WebAssembly code turns them into characters by rejection sampling: random values that would favour some characters over others are thrown away, so every character is exactly equally likely. When you ask for at least one character of each type, the whole password is regenerated until it qualifies, which keeps the result unbiased.
Passphrase or password?
A passphrase of six random words has about 77 bits of entropy and is much easier to type and remember than a random string of similar strength. Words are drawn from the EFF Large Wordlist of 7,776 words, so each word adds about 12.9 bits.
Is it private?
Yes. Everything happens on your device. Nothing is sent over the network, saved in your browser or kept in a history. Once you close or refresh the page, the passwords are gone.
Passphrase words: EFF Large Wordlist by the Electronic Frontier Foundation (eff.org), used under the Creative Commons Attribution 3.0 licence (CC BY 3.0).