Random Password and Passphrase Generator

Every character is chosen with crypto.getRandomValues, the browser's cryptographically secure random generator, not Math.random. Picking a character from a list of, say, 89 options by taking a random number modulo 89 would make some characters slightly more likely than others. This tool avoids that with rejection sampling: random 32-bit values that fall in the uneven tail are thrown away and redrawn, so every character is exactly equally likely.

You can set a length from 4 to 128, tick the character types you want, skip look-alike characters such as l, 1, I, O and 0, and leave out any characters a site refuses. If you ask for every ticked type to appear, a password that misses one is discarded and redrawn. That keeps the result uniform over all valid passwords, unlike the common shortcut of inserting one character of each type and shuffling.

Passphrase mode joins random words from the EFF Large Wordlist, a list of 7,776 words published by the Electronic Frontier Foundation under a Creative Commons Attribution licence. Each word adds log2(7,776), about 12.9 bits, so six words give about 77.5 bits. Passphrases are easier to type and remember than random symbols, which makes them a good choice for a password manager's master password or a disk encryption key.

The strength bar shows entropy: the base-2 logarithm of the number of different results the generator could produce. For a password the formula is length x log2(pool size); with the require-every-type option the exact count is computed by inclusion-exclusion and the formula is shown on screen. The labels are only a guide to that number. This tool does not claim a time to crack, because that depends on how a service stores passwords and on an attacker's hardware, neither of which the page can know.

Use a different password for every account and keep them in a password manager so you never have to memorise them. A long random password is only as safe as the site that stores it, so turn on two-factor authentication wherever it is offered. Current NIST guidance on digital identity (SP 800-63B) favours length and discourages forced composition rules and routine expiry, so if a site allows it, a longer password beats a shorter one with more symbols.

Generated values exist only in this page's memory. They are not sent anywhere, not logged and not saved, and reloading the page clears them. Copy a password straight into your manager rather than leaving it in a note or chat.