Password Generator

Password Generator makes passwords that are genuinely random: 4 to 128 characters from the kinds you choose, or passphrases of 3 to 12 real words. It suits a new email or bank login, a Wi-Fi key, a password manager’s master passphrase, or a batch of starter passwords for a team.

Randomness is the whole point, so it’s done carefully. Every character and word comes from your browser’s cryptographic random generator, the same one used for encryption. Each pick is unbiased: values that would favour some characters over others are thrown away and drawn again. When you ask for at least one of each kind of character, passwords that miss one are discarded and redrawn, so every acceptable password is exactly as likely as any other.

The strength shown is honest. It assumes the attacker knows exactly which settings you used, gives the number of possibilities in bits, and turns that into how long a very fast attack would take. Passwords are made on your device, shown only on this page and forgotten when you leave. Nothing is saved, logged or sent.

1. Choose Password or Passphrase.
2. For a password, set the length with the slider or the number box, and tick the kinds of character to use. Tick “Avoid look-alikes” if you’ll ever type it by hand.
3. For a passphrase, choose how many words, what goes between them, and whether to capitalise them or add a number.
4. Read the strength meter. Aim for Strong or Very strong.
5. Press Copy, or “New one” for another. To make several at once, set “How many”, then use Copy all, “Save .txt” or “Save .csv”.

• Passwords from 4 to 128 characters, using any mix of capitals, small letters, numbers and symbols.
• Your own symbol set, plus a “Never use these” box for characters a website rejects.
• “Avoid look-alikes” removes I, l, 1, |, O, 0 and o, which are easy to confuse.
• “At least one of each kind” for sites that demand it, done without making some passwords likelier than others.
• Passphrases from the EFF large word list of 7,776 words, with your choice of separator, capitals and an added number.
• Strength in bits, a five-step meter and a plain-English time to crack.
• Up to 500 at once, each with its own Copy button, plus Copy all, “Save .txt” (one per line) or “Save .csv” (numbered, with each one’s length), made on your device.
• Uses crypto.getRandomValues with unbiased selection, never Math.random.

• Length beats complexity. Each extra character multiplies the possibilities, so 20 small letters (94 bits) beat 10 characters of every kind (about 64 bits).
• Use a different password for every site, and keep them in a password manager. A long passphrase is a good master password.
• Copying puts the password on your clipboard, where clipboard history tools may keep it. Clear it afterwards if that matters.
• A saved list is a file of real passwords: keep it private and delete it once they are in use. Spreadsheets may read a password starting with =, +, - or @ as a formula, so open the .csv as text if one looks wrong.
• The crack time assumes a fast offline attack. A site that limits login attempts slows attackers far more, but you can’t count on every site doing that.