What is the Password Generator?
A password generator creates a random secret that's hard to guess and easy to paste into a password manager.
This tool produces two flavours: classic random passwords (a soup of upper, lower, digits and symbols at a chosen length)
and EFF-style passphrases (a sequence of common English words joined by a separator). Both are generated
using your browser's crypto.getRandomValues CSPRNG — the same source the OS uses for cryptographic keys — and
nothing ever leaves your machine.
How strong is "strong"?
Password strength is measured in bits of entropy — the base-2 logarithm of the number of possible passwords that could have been generated under the chosen rules. The math is:
- Random passwords:
log2(charsetSize ^ length). A 16-character password drawn from all 94 printable ASCII characters is roughly 105 bits. - Passphrases:
log2(wordlistSize ^ wordCount). Five words from a 1,296-word list is about 51 bits; adding two random digits pushes it past 57. - Any password below 40 bits is weak against modern offline cracking. 60+ is fair, 80+ is strong, 100+ is overkill for almost everything except long-lived encryption keys.
Why passphrases?
Passphrases were popularised by EFF's diceware lists. A six-word
passphrase like correct-horse-battery-staple-rocket-glove has more entropy than most random 10-character
passwords, is dramatically easier to type on a phone keyboard, and is far easier to memorise — a perfect choice for the
handful of high-stakes secrets you actually need in your head (master passwords, full-disk encryption, recovery phrases).
This tool's wordlist
We embed the EFF Short Wordlist (1,296 words, 4-character minimum, autocomplete-friendly). It's public domain, ~12 KB, and gives ~10.34 bits of entropy per word — enough that a 5-word passphrase clears the offline-cracking threshold comfortably while staying short and typeable. For maximum-strength wallets or recovery keys, use the EFF Long list separately.
Tips
- Hit Generate 10 to scan a batch and pick one you find most memorable.
- Always paste generated secrets straight into your password manager — never email or screenshot them.
- Hash and password generators run entirely client-side. You can disconnect from the network before generating if you're paranoid (and you should be, for primary credentials).