Password Generator

Random password or passphrase: two ways to generate

In "Random password" format, every character is drawn from the selected sets. In "Passphrase" format, every word is drawn from a curated list of short nouns (around 110 words, in whatever language you're browsing the site in) and joined with a separator, with optional capitalization, a trailing number, and a trailing symbol. As the tool itself notes, a passphrase's quality depends mostly on how many words it has and the size of the list it's drawn from — not on how complex each individual word looks.

The four quick profiles

"Recommended" uses 20 characters with all four sets active. "Compatible" uses 16 characters with a reduced set of common symbols, for forms that reject rarer ones. "Easy to type" drops symbols and ambiguous characters, favoring error-free manual entry. "Maximum" uses 32 characters with every group active. Choosing a profile fills in every related field at once — length, sets, allowed symbols, and the avoid-ambiguous option — but you can still adjust any field by hand afterward without losing the rest.

Secure randomness and guaranteed coverage

Every character or word is drawn using the browser's cryptography API, with a rejection-sampling technique to avoid bias — not the common Math.random(). The "Guarantee at least one character from each selected set" option forces the result to include at least one lowercase, uppercase, number, and symbol (whenever the chosen length allows it); turned off, every character is drawn fully independently, and a long password could — unlikely as it is — come out missing an entire selected set.

How entropy and strength are calculated

The displayed strength (Weak, Fair, Strong, Very strong) comes straight from the calculated entropy: below 55 bits is Weak, 55 to 74 is Fair, 75 to 99 is Strong, and 100 bits or more is Very strong. It's a theoretical estimate from an ideal brute-force model, which is why the audit card is deliberately labeled "no 'time to crack'" — that kind of estimate depends on assumptions about an attacker's hardware that go stale fast and can create a false sense of security.

Entropy — random password

bits = length × log2(character set size)

Entropy — passphrase

bits = word count × log2(list size), + log2(100) if a number is added, + log2(symbols) if a symbol is added

The quick-read audit checklist

In password format, the checklist shows Length (good from 16 characters up, a warning from 12 up, bad below that), Diversity (good with 3 or more active sets), Readability (informational: ambiguous characters removed or all allowed), and Coverage (good only when "guarantee each set" is on). In passphrase format, it shows Word count (good from 6 words up, a warning from 4 up, bad below that), Draw list (informational, showing the total words available), Extra element (good when a trailing number is added), and Separator (informational).

Variations, and what the tool never keeps

The "Other options" card shows four additional values generated with the same settings, each individually copyable and refreshable with "Refresh variations" without touching the main result. Nothing is saved, sent, or synced: the generated value only lives in the page's state while it's open, so copy it into a password manager before generating another or closing the tab — the previous value can't be recovered after that.