It creates strong, unpredictable passwords for you. Two modes are available: a random password of the length and character types you choose, or a passphrase made of several random words that is easier to remember and type but still hard to guess.
How do I use it?
Pick a mode with the tabs: Random password or Passphrase.
Set the length (or number of words) and options, then click Generate — or press ↻ to roll a new one.
Click 📋 or click the password itself to copy it.
Set "Make N at once" to produce a batch you can copy individually.
Randomness & strength
Is the randomness actually secure?
Yes. Passwords are built with the browser's crypto.getRandomValues() — a cryptographically secure random number generator — not the ordinary Math.random(). Character selection uses rejection sampling so every character is equally likely, with no bias toward the start of the alphabet.
What does the strength meter mean?
It estimates entropy in bits — a measure of how many guesses an attacker would need. Each extra bit doubles the work. The estimate assumes the attacker knows exactly which settings you used (the safe assumption), so it reflects the true difficulty of a brute-force attack, not a lucky guess of your specific password.
How many bits is "enough"?
As a rough guide: under 40 bits is weak, 60–80 bits is strong for most accounts, and 80+ bits is very strong. A 16-character password using all four character types is around 100 bits. When in doubt, longer always beats more exotic symbols.
What does "Avoid look-alikes" do?
It removes characters that are easy to confuse when reading or typing a password by hand — like the digit 0 and letter O, or 1, l and I. Handy for passwords you'll read off a screen, at a small cost to entropy.
Why "include at least one of each type"?
Some sites require a mix of upper, lower, number and symbol. This option guarantees the result satisfies those rules while keeping the placement random. Turn it off for pure, unconstrained randomness.
Passphrases
When should I use a passphrase?
Passphrases like Maple-River-Copper-Fox-42 are far easier to remember and type than random strings, which makes them great for your device login, password-manager master password, or Wi-Fi. With enough words they are also very strong.
How strong are they?
Each word is chosen at random from a built-in list of a few hundred words, so each word adds roughly 8 bits. Four words already gives a solid passphrase; five or six words is very strong. Adding a number and a separator nudges it a little higher.
Privacy
Are the passwords sent anywhere or stored?
No. Everything is generated locally in your browser. Nothing is uploaded, logged, or saved — closing or refreshing the page discards everything. For that reason, copy a password before you navigate away.
Does it work offline?
Once the page has loaded, generation runs entirely on your device, so it keeps working without a connection.
Any tips for staying safe?
Use a different password for every account.
Store them in a reputable password manager rather than reusing or writing them down.
Turn on two-factor authentication wherever it's offered.
Longer is stronger — favor length over hard-to-type symbols.
