Password Generator — Strong Passwords & Passphrases
Create cryptographically strong passwords or memorable passphrases entirely in your browser. Choose length and character sets, or switch to passphrase mode. A live strength meter estimates entropy. Randomness comes from crypto.getRandomValues — nothing is uploaded.
What is a strong password?
A strong password is long and unpredictable. Entropy (bits) estimates how hard it is to guess: mixed 20-character passwords are typically 120+ bits, and a six-word passphrase from a 1024-word list is about 60 bits. This tool uses the Web Crypto API rather than Math.random(), so output is suitable for real account secrets. See: crypto.getRandomValues.
Why Use This Tool
- Account passwords — Generate a unique password per site or app.
- Memorable passphrases — Use several random words instead of a dense character soup.
- Encryption passphrases — Create a high-entropy secret for local encryption. Encryption tool →
- API keys and tokens — For raw random strings without a strength meter, use Random String. Random String Generator →
Tips
- Prefer a password manager and a unique password per site.
- Twenty mixed characters is Very strong for most accounts.
- Passphrases are easier to type; add words rather than clever substitutions.
- Exclude look-alike characters if you must read the password aloud.
How to Use the Password Generator
Choose a mode
Password for mixed characters, or Passphrase for random words.
Set options
Adjust length and charsets, or word count, separator, and extras.
Check the meter
Aim for Strong or Very strong before you copy.
Generate and copy
Click Generate for a new value, then Copy. Nothing is stored.
Worked Examples
Strong mixed password
20 characters, upper + lower + numbers + symbols
About 130 bits of entropy (Very strong)
Each run is different; the sample is a strength description, not a reused secret.
Six-word passphrase
6 words from a 1024-word list, hyphen separated
About 60 bits of entropy (Strong)
Add a digit or more words if you want extra margin.
Password vs passphrase
| Feature | Password | Passphrase |
|---|---|---|
| Shape | Mixed characters | Random words |
| Typing | Harder to type | Easier to type |
| Default strength | Very strong at 20 chars | Strong at 6 words |
| Best for | Password managers | Secrets you must remember |
Frequently Asked Questions
Is this cryptographically secure?
Yes. Bytes come from crypto.getRandomValues (Web Crypto). The generator never calls Math.random(), and selection uses rejection sampling to avoid modulo bias.
What does the strength meter measure?
Estimated entropy in bits from length and charset size, or from word count and word-list size. It is a planning aid, not a guarantee against every attack.
How is this different from Random String Generator?
Random String is a general token generator. This tool is for secrets: passphrase mode, a strength meter, ambiguous-character exclusion, and class coverage. Use Random String for API keys and test tokens.
Does anything leave my browser?
No. Generation, scoring, and copying all run locally. There is no account and no upload.
Should I hash the password here?
Do not store raw SHA hashes of passwords. If you need a checksum of text, use the Hash Generator. For password storage, use bcrypt, scrypt, or Argon2 on the server.