Password Generator

// Is an online password generator safe?

It can be, but only when the random value is made on your device and never sent to a server. This generator uses crypto.getRandomValues in your browser. Generated values are not written to localStorage, cookies, analytics, or a history. The anonymous usage telemetry can record a low-cardinality action such as Generate, but it never includes the generated value. Close or refresh the page and the value is gone.

You can verify the boundary instead of taking the claim on trust. Open the browser's Network panel, generate another password, and inspect any request that appears. When analytics is configured, a first-party event can carry tool and action labels, but it must not contain the result. To test offline use, load the mode you need once, disconnect from the network, and generate again. Passphrase mode loads the EFF wordlist as a separate page asset the first time you select it, then needs no connection.

Client-side generation does not make a compromised device safe. Malware, a hostile browser extension, or someone watching your screen can still capture a password after it is generated. Use a trusted device, give every account a different password, and move the result into a password manager rather than leaving it in a document or message.

// What makes a generated password strong

Length and unpredictable selection do the work. With uppercase letters, lowercase letters, digits, and all printable ASCII punctuation enabled, each position has 94 possible characters. The default 20-character password therefore has floor(20 × log2(94)), or about 131 bits of entropy. Removing character groups or excluding individual characters shrinks that pool, and the number shown beside the result updates with it.

The crack-time line is an average exhaustive-search estimate at 100 billion guesses each second in an offline attack. That is deliberately a much harsher model than an ordinary website login, where rate limits should slow guesses. It is still only a model: hardware changes, leaked password hashes vary in cost, and a reused or human-made pattern is not equivalent to a uniformly generated value of the same length.

When at least one character from every enabled group is required, results missing a group are rejected. The independent-character entropy and crack-time figures are therefore upper bounds, and the exact gap can be substantial for a short password with narrowly constrained groups. Turning the guarantee off restores the stated independent-character model, although a long random result will usually contain every broad group anyway.

// Password or passphrase?

Use a random character password when software will store and fill it for you. Twenty random characters fit most account rules and are easy for a password manager to handle. Use a passphrase when you expect to type or remember the secret yourself, such as a device login, disk-encryption password, or the password that unlocks a password manager.

Passphrase mode selects each word independently from the Electronic Frontier Foundation's 7,776-word large list. Every random word contributes log2(7,776), about 12.9 bits, so five words show about 64 bits and six show about 77 bits. EFF currently recommends at least six words from its long list for valuable secrets. Capitalization and separators are deterministic formatting choices; the optional final digit helps with site rules, while the displayed entropy conservatively counts only the word choices.

A passphrase is strong because the words are selected randomly, not because it resembles a sentence. Do not replace a generated word with a favorite, quote, name, or related word. That makes the result easier to guess in a way the entropy number no longer describes.

// fair questions

Is it safe to use an online password generator?

Only if it generates locally and does not transmit or retain the result. This one uses your browser's crypto.getRandomValues source and stores no generated value. Anonymous usage telemetry may send tool and action labels, but it never includes the generated value. You can inspect those requests in the Network panel or generate again with the network disconnected. A compromised device or browser extension can still see what you see, so use a trusted device.

How does this generator make random passwords?

It draws cryptographic random bytes with crypto.getRandomValues and maps them into the enabled character pool with rejection sampling. Values in the uneven remainder are discarded instead of using a biased byte modulo the pool size. When at least one of each group is required, the whole password is generated again until it qualifies, so no character or position is favored.

How long should a password be?

For a uniformly random character password, 16 characters with a broad character pool is a practical minimum for ordinary accounts, and this tool defaults to 20. A passphrase intended for a valuable memorized secret should use at least six independently selected EFF words. Longer is useful when a site allows it; uniqueness matters too, because one strong password reused across accounts can still be exposed by one breach.

What is a passphrase, and when should I use one?

A passphrase is a sequence of independently selected random words. It is longer to type than a character password but can be easier to remember, which makes it useful for a device login, full-disk encryption, or a password-manager master password. This mode uses EFF's 7,776-word large list and shows the entropy supplied by the number of words.

Are generated passwords stored anywhere?

No. Generated passwords and passphrases stay in this tab's memory only. They are not sent to a server and are not written to localStorage, cookies, or a saved history. Generate a replacement, refresh, or close the page and the old value is gone, so copy it into its intended password field or a password manager before leaving.