Password Generator
Random passwords or memorable passphrases, generated with your browser's cryptographic random number generator. Never sent anywhere, regenerates live as you tune the options.
How the strength meter works
Based on real entropy, not a guess.
Entropy is calculated from the actual pool size and length: character passwords use
length × log2(pool size), passphrases use words × log2(word list size).
Under 40 bits is crackable quickly offline; 60+ bits is solid for most accounts; 90+ is
overkill in a good way.
Why passphrases
A random string like xK9#mQ2p is hard to remember but not necessarily
stronger than coral-lantern-otter-42, and the second one you can actually
type without looking. The word list here has ~390 words, so more words closes the
entropy gap with true random characters.
How it works
Every random draw comes from crypto.getRandomValues, the browser's
cryptographically secure generator backed by the operating system's entropy source,
never Math.random, whose output is predictable enough to reconstruct.
There's a subtlety on top: mapping random bytes onto a character pool with a plain
modulo skews the distribution, because 256 rarely divides evenly by the pool size,
making some characters slightly more likely than others. This tool uses rejection
sampling instead: any byte value above the largest even multiple of the pool size is
thrown away and redrawn, so every character is exactly equally likely. After
generating, it also checks that each character set you enabled actually appears and
swaps one in at a random position if not, since sites often reject passwords missing
a required class.
A consequence of the entropy math worth internalizing: length beats complexity. Each character contributes log2 of the pool size, so turning on the full symbol set adds about half a bit per character, roughly 8 bits across a 16-character password, while simply making it two characters longer adds about 12. If a site's symbol rules fight you, growing the length wins the argument every time.
You can verify the privacy claim directly: open DevTools, switch to the Network tab, and hit Regenerate a few times. Nothing fires. The page generates passwords with no connection at all, and nothing is stored, so a generated password exists only in this textbox and your clipboard.
Common questions
Is it safe to generate a password in the browser?
Yes. Passwords are generated locally with crypto.getRandomValues, your browser's cryptographic random number generator, and are never sent, stored, or logged. Regenerating just runs the same code again on your device.
How does the strength meter work?
It's based on real entropy, not a pattern guess: length times log2 of the character pool for random passwords, and word count times log2 of the word list size for passphrases. Under 40 bits is quickly crackable offline, 60+ bits is solid for most accounts, and 90+ is overkill in a good way.
Should I pick random characters or a passphrase?
If a password manager fills it in for you, random characters are fine. If you have to remember or type it, a passphrase like coral-lantern-otter-42 is far easier to handle, and adding a word or two closes the entropy gap with random characters.
What does "Exclude ambiguous" do?
It skips characters that look alike: 0 and O, plus 1, l, and I. That helps when a password has to be read off a screen or typed by hand. The slightly smaller pool is reflected honestly in the entropy calculation.
From the blog: Password Entropy, Explained With Real Numbers