Password generator
Random passwords and passphrases, made right here in your browser with real randomness. Nothing you generate goes anywhere. Not even to us.
0 bits
Fair
20 CHARS 0 BITS 4 SETS
Earlier this session
The last five, kept in memory only. Close the tab and they are gone.
Nothing yet. Generate another one and the current one lands here.
How it works
Every character and every word comes from crypto.getRandomValues, the same source your browser uses for encryption keys. Picking one item from a set of 94 with a random 32-bit number would slightly favour the first few characters, so this page throws away the rare values that would cause that skew and draws again. That is rejection sampling, and it means no modulo bias.
Bits are the honest size of the space. A random password is length times log2 of the character pool, and when you ask for every set at least once the count is corrected for the combinations that rule leaves out, so the number can only go down, never up. A passphrase is words times log2 of 7,776, which is 12.9 bits a word. Capitalising one word adds log2 of the word count; adding a digit adds log2 of ten times the word count. Nothing else on this page changes the number.
Time-to-crack assumes an attacker who knows exactly how the password was made and can test ten billion guesses a second, roughly a rack of graphics cards against a fast hash, or a trillion a second, which is a state-sized budget. The figure shown is the average case, halfway through the space. If the service storing your password hashes it slowly, the real number is far larger. If they store it in plain text, nothing here helps.
The passphrase words are the EFF long wordlist, 7,776 words chosen to be memorable, unambiguous and easy to type. It ships with this page as a plain list, so nothing is fetched when you generate.
Nothing you generate is sent, logged or stored. The only thing this page records is that a password was made, and how many bits it had.