Password and passphrase generator
Random character passwords for a password manager, or word-based passphrases for the handful you have to type from memory. Generated with your browser's cryptographic random source and never sent anywhere.
- No signup
- Runs in your browser
- Works offline
- Nothing is uploaded
- Free
A password generator that runs on a server has an obvious problem: the server knows the password it just gave you. This one uses crypto.getRandomValues, the browser's cryptographically secure random source, entirely inside the page. Nothing is transmitted, nothing is logged, and nothing is stored after you close the tab.
Two modes, because the right answer depends on the job. For the hundred accounts your password manager handles, use long random characters — you will never type them. For the three or four you must type from memory (the manager's own master password, your laptop login, your phone backup) use a passphrase: several random words are far easier to remember and, at five or six words, stronger than most character passwords people actually choose.
How to use this tool
- Pick random characters or a passphrase, depending on whether you will type it by hand.
- For random characters, set the length — twenty is a sensible default — and choose which character sets to include.
- Leave ambiguous characters excluded if you might ever read the password aloud or copy it from a screen; it removes the confusable pairs like 0/O and 1/l/I.
- For a passphrase, choose how many words. Five words is the sensible minimum for anything important.
- Check the entropy figure below the result. It counts how many random bits there are, which is a far better measure than a coloured strength bar.
- Copy it straight into your password manager, or generate a batch if you are setting up many accounts at once.
Worked example
A master password you have to remember
You need one strong password to unlock everything else, and you will type it several times a day. Six random words with dashes gives roughly 77 bits of entropy — stronger than most twelve-character random passwords, and you can actually commit it to memory.
Fifty service accounts
You are provisioning accounts for a small team. Use random characters at 24 length, generate a batch, and paste them into your password manager. Nobody types these, so memorability does not matter.
Common use cases
- New accounts stored in a password manager
- A master password or device login you must type from memory
- Wi-Fi keys that people will read off a card
- Database and service credentials during setup
- Temporary passwords issued to someone else
- Recovery phrases and backup codes that need to be written down
Common mistakes
- Substituting characters in a word —
P@ssw0rd!is not strong. Cracking tools apply every common substitution automatically; the pattern is as predictable as the word. - Choosing the words yourself — A passphrase only works if the words are chosen at random. Words you pick yourself follow the patterns of your own vocabulary and are dramatically weaker.
- Adding complexity instead of length — One more character adds far more strength than sprinkling in symbols. Length is the variable that matters most.
- Reusing a strong password — Strength does not survive reuse. One breach at any site exposes every account sharing it — which is the entire argument for a password manager.
Frequently asked questions
Is the password sent anywhere?
No. It is generated in your browser with crypto.getRandomValues and displayed on the page. There is no request, no logging and no storage. Close the tab and it is gone.
How random is it really?
crypto.getRandomValues is the browser's cryptographically secure random number generator, seeded by the operating system. It is the same source used for real cryptographic key material, and is not related to Math.random, which is not suitable for secrets.
What does the entropy figure mean?
It is the number of random bits — every extra bit doubles the number of possible passwords. Under about 40 bits is weak, 60 is reasonable for low-value accounts, and 80 or more is appropriate for anything that matters. It is measured from the generator's settings, so it reflects genuine randomness rather than guessing at patterns.
Are passphrases really as strong as random passwords?
They can be, if the words are random and there are enough of them. Five words from this list is about 64 bits and six is about 77. The advantage is that people will actually use a strong one rather than shortening it.
Should I include symbols?
They help a little, and some systems insist. But going from 16 to 20 characters adds more strength than adding symbols to a 16-character password. If a site rejects symbols, just make it longer.
Can I generate many at once?
Yes — set a count and use the bulk button. They are generated with the same settings and the same random source.
Last updated 2026-09-26