Password Generator
Build a strong random password or a memorable passphrase - generated in your browser with real cryptographic randomness, never sent anywhere.
How the generator works
Every password and passphrase here is built with crypto.getRandomValues, the
browser's cryptographically secure random number generator. Crucially, the code uses
rejection sampling rather than a plain modulo, so there is no bias toward any part of the
character set - each character is equally likely. All of it runs locally on your device: no
password is transmitted, saved or visible to anyone but you. You can even switch off your
network and it still works.
Random passwords vs passphrases
A random password packs the most strength into the fewest characters, which is ideal when a
machine remembers it for you in a password manager. A passphrase - several unrelated words
like river-copper-lantern-fox - trades a little length for something you can
actually memorise and type on a phone. Both are strong when they contain enough randomness;
what makes a password weak is predictability, not the lack of a stray symbol.
What the strength meter means
The meter shows entropy in bits, a measure of how many guesses an attacker would need. It is calculated from the size of the character pool and the length: a 16-character password drawn from all four sets is around 100 bits, which is uncrackable with today's hardware. As a rough guide, under 45 bits is weak, 45 to 70 is fair, 70 to 90 is strong and above 90 is excellent. Adding length raises entropy far faster than adding exotic symbols, so when in doubt, make it longer.
Good habits
Use a unique password for every account, store them in a password manager, and turn on two-factor authentication wherever it is offered. Need other quick utilities? Try the UUID generator for unique identifiers, the hash generator to verify file integrity, or the random number generator for fair draws.