Create strong random passwords or word-based passphrases using your browser cryptographic random number generator. Tune the length and character sets, or switch to passphrase mode, and watch the entropy in bits update live so you can judge real strength rather than guessing.

How to use it

  • Pick a mode: a random character password, or a passphrase built from words.
  • Set the length, or the number of words for a passphrase.
  • Toggle uppercase, lowercase, digits and symbols to satisfy whatever rules a site imposes.
  • Watch the entropy readout, then copy the result straight into your password manager.

Why entropy is the only honest measure

Password strength meters that scold you into adding an exclamation mark measure the wrong thing. What actually resists guessing is entropy, the base-2 logarithm of how many equally likely passwords the generator could have produced. A password drawn from a 62-character alphabet carries about 5.95 bits per character, so a 16-character password is roughly 95 bits. Each additional bit doubles the attacker workload.

Length dominates. Adding one character to a random password multiplies the search space by the alphabet size, whereas swapping a for @ in a dictionary word adds almost nothing, because cracking rules apply exactly that substitution automatically. This is why a long passphrase of ordinary words can beat a short password littered with punctuation: four random words from a 7776-word list give about 51.7 bits, six words about 77.5 bits, and unlike a character soup you can actually retype it when you must.

Randomness that is fit for purpose

This generator draws from crypto.getRandomValues, the browser cryptographically secure pseudo-random number generator, and it rejects modulo bias when mapping raw bytes onto the chosen alphabet. That distinction matters: Math.random is a fast statistical generator whose internal state can be recovered from a handful of outputs, making anything derived from it predictable. No secret you rely on should ever come from it. Generation happens entirely inside your browser, so no password produced here is transmitted or recorded anywhere.

Frequently asked questions

How long should a password actually be?

For anything stored in a password manager, use the longest the site permits, ideally 20 characters or more of random output, since you never type it. For a password you must memorise, such as the master password or a disk-encryption passphrase, prefer six or more random words. Aim for at least 80 bits of entropy on anything protecting real assets.

Are passphrases weakened by using common words?

Not if the words are chosen randomly and you assume the attacker knows the word list. Security comes from the number of possible combinations, not from the obscurity of the vocabulary. What does destroy a passphrase is choosing the words yourself, or using a quotation, song lyric or memorable phrase, because those are drawn from a vastly smaller and heavily targeted space.

Can the same password be generated twice?

In principle any random process can repeat, but at these entropy levels the probability is negligible. Nothing is stored between generations, so the tool has no memory of what it produced and cannot check for repeats.

Related tools: Password Checker, UUID Generator, Hash Analyzer.