Strong Password Generator — Runs In Your Browser, Nothing Is Sent

1. 1Choose the typeRandom characters give the most strength per character and suit anything you will paste from a password manager. Memorable words are easier to type by hand on a phone or a TV.
2. 2Set the optionsDrag the length or word count until the strength reads Strong or better. For random passwords, keep all four character types on unless a site rejects symbols.
3. 3Copy and save itSelect Copy, then paste the password straight into your password manager. Generate a new one for every account rather than reusing this one.

Strength is measured in bits of entropy, which is the number of guesses an attacker would have to make. Each extra bit doubles that number. This page reports the true figure, calculated from the length and the size of the character set the tool actually drew from, not an estimate made by inspecting the finished string.

The randomness comes from crypto.getRandomValues, the browser's interface to the operating system's cryptographic random source. The tool also uses rejection sampling when picking each character: taking a random byte modulo the alphabet size would quietly favour the first few characters and produce less entropy than the number shown.

Against a fast offline attack at roughly 10 billion guesses per second, 45 bits falls in hours, 60 bits takes years and 80 bits is beyond reach with current hardware. A 20-character password drawn from all four character types carries about 130 bits, which is far past that threshold.

A passphrase reaches the same place differently. Each word is drawn from a 256-word list, so it contributes exactly 8 bits. Five words plus a two-digit number is about 47 bits; eight words is about 71 bits. Words need more characters for a given strength but are far easier to read aloud and retype.

A generated password is only useful if you do not have to remember it. Store it in a password manager and let that fill it in; the one password worth memorising is the one that unlocks the manager, which suits the memorable-words mode. Never reuse a password across sites: a breach at one becomes a break-in everywhere else. Turn on two-factor authentication wherever it is offered.

The password is generated in your browser and written straight to the page. It is not sent to a server, saved in browser storage or included in any analytics event. That is also why this page cannot show you an earlier password: it was never kept.