password generator

Yes. Passwords are generated in your browser with the Web Crypto API (crypto.getRandomValues), the same cryptographic random source browsers use for encryption keys. Nothing is sent to a server, logged or stored, and the page works even if you go offline after it loads.

For random passwords, 16 characters with all four character types is a good everyday minimum, and 20 or more is better for email, banking and admin accounts. For passphrases, five or six random words is a strong choice. The strength meter shows the exact figure for each password.

From how the password was made, not how it looks. The tool counts the bits of real randomness (for example 20 random characters from 90 symbols is about 129 bits) and assumes an attacker knows the method and can try 10 billion guesses a second offline. That is why a leetified name scores low unless you add random characters.

On their own, not very: attackers’ wordlists already include phrases, names, dates and every @-for-a swap. The strength booster adds random characters on the end, which is where the real strength comes from. Use these modes for low-risk accounts, or turn the booster up for anything important.

Several random words joined together, such as Statue-Visor-Gumdrop-Waffle-Length03. Each word comes from the EFF Short Wordlist of 1,296 easy-to-type words and adds about 10 bits of strength. Passphrases are easier to type and remember than random characters of the same strength.

Characters such as I, l, 1, O and 0 are easy to misread when you type a password from a screen or a printout. Turning on “avoid look-alikes” removes them, at the cost of a tiny amount of strength.

No. If one site leaks, attackers try the same email and password everywhere else. Use a different password for every account, store them in a password manager, and turn on two-factor authentication where you can.