Password Generator — strong random passwords & passphrases

This password generator creates strong, random passwords and memorable passphrases right in your browser. Pick the length and which character sets to include, or switch to passphrase mode for a word-based secret that is easy to type and remember — the tool shows a live strength rating and an entropy estimate so you can see exactly how hard the result is to guess.

Character-mode passwords are drawn from `crypto.getRandomValues`, the browser’s cryptographically secure random source, so the output is not a predictable `Math.random()` sequence. Everything is 100% client-side: nothing you generate is sent anywhere, and 0 bytes leave your browser.

Usage

1. Read the generated secret on the "output" line. Click ↻ to regenerate a fresh one, or ⎘ to copy it to the clipboard.
2. Check the readout below the output: a Weak / Medium / Strong rating, the approximate bits of entropy, and a colored strength bar that fills as the secret gets stronger.
3. Choose a mode: "random characters" for a classic password, or "passphrase" for a sequence of dictionary words.
4. Drag the slider to set the length (8–128 characters) or, in passphrase mode, the number of words.
5. In character mode, toggle the character sets — Uppercase (A–Z), Lowercase (a–z), Numbers (0–9), Symbols (!@#$) — and "exclude ambiguous (0 O 1 l)" to drop look-alike characters. In passphrase mode, toggle "use hyphens as separators".

Examples

A strong 20-character password: length 20 · upper + lower + numbers + symbols

The default: 20 characters drawn from a ~90-character pool gives roughly 130 bits of entropy and a "Strong" rating. This is the safe choice for an account you log into rarely and store in a password manager — long and random beats short and clever.

A memorable passphrase: passphrase mode · 4 words · hyphen separators

Switch to passphrase mode and you get something like `phoenix-galaxy-amber-thunder` — easy to type from memory yet still strong because length, not symbols, carries the entropy. Turn off "use hyphens" to separate the words with spaces instead.

No ambiguous characters: exclude ambiguous (0 O 1 l)

Enable "exclude ambiguous" to remove the look-alike characters 0/O and 1/l from the pool. Useful when the password will be read aloud, copied by hand, or typed on a device where those glyphs are hard to tell apart — at the cost of a slightly smaller character pool.

FAQ

How do I generate a strong password?

Keep all the character sets enabled and set the length to 16 or more — the longer the password, the more entropy it has and the harder it is to brute-force. Aim for the "Strong" rating, then copy the result with the ⎘ button and store it in a password manager.

Is this password generator secure / are the passwords really random?

Yes. Character-mode passwords are generated with `crypto.getRandomValues`, the browser’s cryptographically secure pseudo-random number generator, rather than the predictable `Math.random()`. Generation happens entirely client-side, so no password is ever transmitted, logged or stored — 0 bytes leave your browser.

What is password entropy and how many bits do I need?

Entropy measures how many guesses an attacker would need, in bits: it is roughly `length × log2(poolSize)` for a random password. More bits is exponentially harder to crack — anything around 80 bits or more is considered strong for most accounts, and the readout shows the estimate for your current settings as you adjust them.

Should I use a password or a passphrase?

Use a long random password (stored in a manager) when you never have to type it, and a passphrase when you must remember it — a master password, a device login, a Wi-Fi key. A four- or five-word passphrase is both memorable and strong, because the length does the work that symbols do in a character password.

Why exclude ambiguous characters?

The "exclude ambiguous (0 O 1 l)" toggle drops the characters that are easy to confuse when read or typed by hand — zero vs capital O, one vs lowercase L. Leave it off for maximum entropy; turn it on when the password has to survive being dictated, written down or entered on a fiddly keypad.