Password Generator

What you're looking at

Each password is a series of independent draws from the character pool you selected, using your browser's cryptographic random source — the same one your operating system uses. The draws are unbiased (the code discards the rare skewed values rather than taking a shortcut), so every password of a given length is equally likely.

What matters is entropy: roughly length × log₂(pool size) bits. Each extra character multiplies the work an attacker must do by the pool size — going from 12 to 16 characters over the full pool does more than adding every symbol type at 12. The meter below the result translates the bits into an average time for a very fast offline attacker (a trillion guesses per second, e.g. against a stolen password database).

Two honest caveats. The estimate assumes the password is the only thing standing in the way — a site that limits login attempts or checks for breached passwords changes the picture in your favor, and a site that stores passwords badly can void it entirely. And the strongest practical setup remains a password manager plus a different password per site; a generator like this one is how the manager's entries get made.

Avoid look-alikes removes I l 1 O 0 o — handy for passwords you occasionally have to read off one screen and type onto another. No repeated characters makes each character unique; that trades a little entropy (the pool shrinks with every draw) for fewer doubled-up letters.

Passphrases

The passphrase mode picks whole words from a built-in list of 2,048 short common English words, so each word carries exactly 11 bits of entropy — a four-word passphrase is in the same strength class as a 12-character random pool password, but it's one you can actually remember, dictate over a phone call, or type on a TV remote. The list is embedded in this page, so passphrases still never leave your device. The optional number adds about 6.6 bits; Capitalize is purely cosmetic — it changes no entropy, it just makes an unseparated passphrase easier to read.

Words are drawn with the same unbiased random source as the character mode. If a site caps the length, note that a 9-letter word runs longer than most people's old passwords — four words with hyphens is around 28–35 characters. Word list adapted from EFF's Diceware list (CC BY 3.0).