Password Generator
Generate strong random passwords and EFF wordlist passphrases in your browser, with the entropy of each shown in bits.
Local workspace
Named projects in IndexedDB · Local only — never synced to our servers. Worksp…
A password is only as good as the randomness behind it, which is why this generator uses the browser's cryptographic random source and rejection sampling rather than a shortcut like modulo, which quietly favors some characters. Every generated password contains at least one character from each class you enable, so short passwords can't accidentally miss one. The passphrase mode uses the EFF short wordlist, 1,296 words picked to be short, distinct, and easy to type, and reports entropy so you can compare a six-word phrase against a random string honestly. Nothing here is saved, shared, or sent anywhere.
Common errors and fixes
Password must include a special character
Turn on Include symbols. If the site rejects a specific symbol, generate again; the pool is shuffled each time.
Password is too long for this site
Lower Length to 16 or 20. Some sites silently truncate long passwords, which breaks the next login.
Spaces are not allowed in passwords
Choose the hyphen, period, or underscore separator for passphrases instead of a space.
The generated password wasn't saved
Nothing is stored here. Paste it into your password manager first, since reloading the page generates a different one.
Options
| Option | Description |
|---|---|
| Mode | Random characters are compact. Word passphrases are far easier to type and remember at the same strength. |
| Length | Characters per password. One from every selected class is always included. |
| Include symbols | Adds !@#$%^&*()-_=+[]{};:,.?/~ to the pool. Turn it off for systems that reject punctuation. |
| Avoid look-alikes | Leaves out 0, O, o, 1, l, I, and |, which are easy to misread when a password is written down or read aloud. |
| Words | Each word adds about 10.3 bits of entropy, so six words is roughly 62 bits. |
| Separator | What goes between words. Some sites reject spaces. |
| Capitalize words | Capitalizes each word for sites that require an uppercase letter. It doesn't add entropy. |
| How many | Number of passwords to generate at once. |
| Output | JSON also reports the entropy in bits for the settings you chose. |
FAQ
How long should a password be?
For an account you care about, 16 or more random characters is a sensible floor, which is roughly 95 bits of entropy. Length matters far more than exotic symbols: a long random password beats a short one with punctuation sprinkled in.
What makes a word passphrase strong?
Strength comes from words chosen at random from a known list, not from the words being obscure. Six words from the EFF short list is one of 1,296 to the power of six combinations, about 62 bits, and an attacker who knows the list and the method still has to search all of them.
Are these passwords really random?
They use crypto.getRandomValues, the same generator browsers use for cryptography, and pick characters with rejection sampling so no character is more likely than another. Nothing is seeded from the clock.
What does the entropy number mean?
It's the base-2 logarithm of how many equally likely results the settings can produce, so every extra bit doubles the work to guess it. Around 60 bits is fine where an online service rate-limits guesses; aim higher for anything an attacker could crack offline.
Why would I avoid look-alike characters?
Because 0 and O, or 1, l, and I, get misread when a password is typed from paper or read out loud. It shrinks the pool slightly, and the entropy shown already accounts for that.