How to use it
Under “Generation mode,” pick either random characters or a passphrase. In random-character mode, set the length (8 to 128 characters) and the character sets to include (lowercase, uppercase, digits, symbols) — you can edit the symbol set yourself. In passphrase mode, choose the word count (3 to 10), the separator, and whether to capitalize each word or add a number at the end. Press “Generate” to create up to 20 at once, each with its own copy button.
Why cryptographic randomness matters
This tool builds passwords from the browser’s crypto.getRandomValues. The usual Math.random() is a predictable algorithm (a pseudorandom number generator) — knowing earlier values can sometimes let you guess the next one, which makes it unsuitable for security. crypto.getRandomValues draws on a cryptographically secure randomness source provided by the operating system, and it picks each character with rejection sampling, which removes modulo bias so every character has exactly the same chance of being chosen.
What entropy means
Entropy measures, in bits, how many guesses an attacker would need if they tried every possible combination one by one. A random string’s entropy comes out to roughly “length × log2(pool size).” A passphrase draws words without repeats, so its true entropy is slightly lower than that simple formula (picking 4 words from a 256-word list lands very close to, but a bit under, 4 × log2(256) = 32 bits). This tool labels anything under 40 bits as weak, 40-59 bits as fair, 60-79 bits as strong, and 80 bits or more as very strong.
Passphrase vs. random string
At the same length, a random string reaches higher entropy the more character sets it draws from, but it’s harder for a person to memorize. A passphrase chains together real words, so it’s easier to read and type, while adding more words raises its entropy just as effectively (the same idea behind Diceware). Passphrases work best for anything you type by hand often, like unlocking a device or a password manager’s master password; random strings suit accounts you save once and rarely re-enter yourself.
Never reuse a password
If one site’s password leaks, every other account using that same password becomes exposed too (credential stuffing). Use a different password from this tool for each site and save it in a password manager such as 1Password or Bitwarden, so you never have to memorize a new one yet stay protected. Turn on two-factor authentication (an OTP app, a security key, etc.) on your important accounts whenever you can.
Privacy
Every generated password and any character or word you type is computed only inside this browser and never sent anywhere. Nothing is stored on a server, and it all disappears the moment you reload or close the page.