Password Generator
Create a strong random password or an easy-to-remember passphrase, generated with your browser's cryptographic random number generator — never sent anywhere.
How to use this tool
- Choose Password for random characters or Passphrase for memorable word combinations.
- Adjust the length and character options — the password regenerates instantly.
- Check the strength estimate, then copy the result.
How it works
Passwords are generated with your browser's cryptographically secure random number generator (crypto.getRandomValues) — not the predictable Math.random. Every selected character type is guaranteed to appear at least once, and the result is shuffled so those guaranteed characters aren't in predictable positions.
The strength estimate is entropy in bits: length × log₂(alphabet size). Each added character multiplies the search space, which is why a 16-character password is astronomically stronger than a 10-character one — and why length beats complexity tricks.
Passphrases draw from the EFF Large Wordlist (7,776 words), so each word adds log₂(7776) ≈ 12.9 bits: the default 5 words gives ~64.6 bits before the optional number. This is the same list used by EFF's dice-generated passphrases.
Sources & references
- NIST SP 800-63B — Digital Identity Guidelines: Authentication (password length over composition rules)
- EFF — Dice-Generated Passphrases and the EFF Large Wordlist
Content last reviewed: July 2026.
Frequently asked questions
Is it safe to generate a password on a website?
It is here, because generation happens entirely in your browser using its cryptographic random source — nothing is sent over the network. You can verify this: the page works even offline once loaded.
Password or passphrase — which should I use?
For accounts where you type the secret by hand (a laptop login), a passphrase like Copper-Meadow-Falcon-42 is easier to type and remember at similar strength. For accounts stored in a password manager, use maximum-length random passwords.
How long should a password be?
At least 16 characters for anything important. Length adds strength faster than any other factor.
Should I use a password manager?
Yes. The biggest real-world risk is password reuse across sites, and a manager solves that by letting every account have its own strong random password.