Password Generator
High-entropy passwords and passphrases, with the entropy shown.
Strength is arithmetic, not a colour bar
Most password fields show a meter that turns green when you add a capital
letter and a digit. Those meters measure whether you followed a composition
rule, not how hard the password is to guess — which is why
Password1! scores well and is among the first thousand
candidates any real attacker tries.
The number shown here is entropy in bits, and it is calculated the honest way: the size of the alphabet you selected, raised to the length, expressed as a base-2 logarithm. It describes the size of the space an attacker has to search, assuming they know exactly which settings you used — which is the correct assumption, because this page is public.
How many bits you actually need
- Below 50 bits — falls to a determined offline attack. Fine for a throwaway account, not for anything you care about.
- 60–70 bits — resists offline cracking of a properly hashed credential. A reasonable floor for real accounts.
- 80+ bits — comfortable for anything valuable, and the right range for a password manager's master password.
- 128 bits — key territory. Not wrong, just past the point where the password is the weak link.
Length buys entropy far more cheaply than character variety. Adding symbols to a 12-character password gains you about 13 bits; adding four more characters gains you about 26. This is the whole argument for passphrases.
Passphrases
A passphrase draws whole words at random from a fixed list. The list here holds 789 short, unambiguous English words, which is about 9.6 bits per word — so seven words lands near 67 bits, comparable to a good random password and dramatically easier to type on a phone or read aloud. Classic Diceware uses 7,776 words for 12.9 bits each; this list is smaller so the page stays light, and the entropy figure is calculated from the real list size rather than a quoted ideal.
The critical word is random. A phrase you chose yourself, however obscure it feels to you, is not random and does not earn this estimate — human-chosen phrases cluster hard around song lyrics, film quotes and stock idioms. Every word here is drawn with the same CSPRNG as the passwords.
The look-alike option
Removing 0/O and 1/l/I costs a little entropy and
saves real frustration for anything that will be transcribed by hand or
read aloud. For a password going straight into a manager, leave it off.
Nothing is stored, sent, or logged
Generation happens in this tab using crypto.getRandomValues.
The value is never written to storage, never included in an analytics
event, and never sent anywhere. Close the tab and it is gone — which is the
only acceptable design for a tool like this, and the reason to be
suspicious of any password generator that needs a server.