Password Generator
Generate a strong random password, an easier-to-remember passphrase, or a PIN. Uses your browser's cryptographically secure random number generator — the same kind used for encryption, not a weaker everyday random function — and nothing you generate here is sent anywhere.
Passwords vs. passphrases
A random password like K9$mPq2#vL7n packs more entropy per
character, but it's essentially impossible to memorize. A passphrase
like Correct-Horse-Battery-Staple7 is longer but built
from words you can actually read and recall — and with enough
words, it can hold just as much entropy. The passphrase mode here uses
the EFF's curated word list, built specifically for this purpose: every
word is common, unambiguous, and easy to type.
Frequently asked questions
Is this actually secure, or just "random-looking"?
It's actually secure. Generation uses your browser's
crypto.getRandomValues(), a cryptographically secure
random number source (the same category used for encryption keys),
not Math.random(), which is fast but not safe for
anything security-sensitive. Everything happens locally in your
browser — nothing generated here is transmitted anywhere.
How is the strength estimate calculated?
As entropy in bits: for a password, length × log₂(character set size); for a passphrase, number of words × log₂(7,776), since the wordlist has 7,776 words. The estimated crack time assumes an offline attacker guessing 10 billion passwords per second, a commonly cited figure for a well-resourced attacker with modern hardware — treat it as an order-of-magnitude estimate, not a guarantee.
Why exclude ambiguous characters?
Characters like 0/O or 1/l/I
can look identical in some fonts, which matters if you're ever going
to type the password by hand (reading it off a screen or printout)
rather than copy-pasting it. If you'll always copy-paste, it's safe
to leave this off for slightly more entropy.
Should I reuse a password across sites?
No — a unique password per site is what actually limits the damage of any single breach. A password manager is the practical way to do that without memorizing dozens of random strings; this tool is for generating them, not storing them.