Press Generate and the field above fills with a secret created by your browser’s own cryptographic random source. The controls on the left shape what kind of secret you get — a random password or a memorable passphrase — and the analysis on the right tells you, honestly, how strong it is. Everything happens on your device: no generated password is ever sent, logged, or stored.
How the generator works
Randomness comes from crypto.getRandomValues, the browser’s interface to its operating system’s secure random generator — the same source used for TLS keys, not the predictable Math.random. Characters are drawn with rejection sampling, a technique that avoids the subtle bias that modulo arithmetic introduces when mapping random numbers onto a character pool. The guarantee at least one character from every selected class is baked in before a final secure shuffle, so aB3! passwords never come out with all digits at the end.
The Length slider goes from 4 to 64 characters. Each character class (lowercase, uppercase, digits, symbols) toggles independently. Exclude ambiguous characters removes the lookalikes — il1Lo0O and friends — which matters when a password will be read aloud or typed from paper. Custom symbols lets you add exactly the characters a specific site allows, since every site seems to invent its own rules.
Passphrases with real words
Switch to Passphrase mode for the xkcd style of secret: several words from the EFF short wordlist joined by a separator you choose, optionally capitalized and with a four-digit number appended. Five words from the 1,296-word list carry about 55 bits of entropy; six words carry about 66 — comparable to a 10–12 character random password, but typeable from memory and sayable over the phone.
Honest strength numbers
The strength card shows the entropy in bits and a verdict, and the crack-time table converts those bits into time-to-guess under four attack models: an online attacker throttled to 100 tries per hour, an unthrottled online attacker at 10 tries per second, an offline attacker working through a properly slow hash at 10,000 tries per second, and a serious offline rig with a fast hash at 10 billion tries per second.
Those numbers are estimates, not promises — real attackers use dictionaries, reuse breaches, and know that humans pick patterns. That is exactly why the entropy math here counts the generating process, not the appearance of the result: a 6-character password and a 6-word passphrase are judged by how much randomness they actually contain. A 20-character password from a 88-character pool is beyond every one of the four scenarios; a 6-character one falls in minutes. The table makes the difference visible.
Bulk generation and privacy
Set Generate in bulk to 5, 10, or 20 to get a list of independent secrets, each with its own copy button and its own entropy hint — useful when creating accounts for a whole team or a batch of throwaway registrations. Options persist locally between visits; generated secrets never do. The Copy button hands the current secret to your clipboard and nothing else — there is no history feature, no “recent passwords” panel, and no server-side anything. Regenerate at will; the old secret is simply gone.
Frequently asked questions
Are these passwords safe to use? They are generated with the browser’s cryptographic random source and no bias in the character selection — the same quality a local password manager produces. As always, use unique passwords per site and enable two-factor authentication where it matters.
Why trust a web page with my passwords? The generator has no network involvement: the code is static, generation runs locally, and you can disconnect from the internet before generating to verify it still works.
What entropy should I aim for? 80+ bits is strong for a password on a properly secured service; 110+ is comfortable for anything you plan to keep for years. Passphrases reach 80 bits at six EFF words.
Can I generate PINs? Yes — turn off everything except digits and set the length to 4 or 6.