How the generator works
Randomness comes from crypto.getRandomValues, which MDN describes as providing cryptographically strong random values, and not from Math.random. To pick one item from N possibilities, the tool draws a 32-bit random number and discards any value that would favour some items (rejection sampling), so there is no modulo bias. Password mode guarantees at least one character from each set you ticked and then shuffles the result with a Fisher-Yates shuffle that uses the same unbiased draw.
- Random password: length 4 to 128 and any mix of lowercase, uppercase, digits and symbols (27 symbols). An option removes lookalikes such as I, l, 1, O and 0.
- Passphrase: 3 to 12 words from an embedded list of 1,170 short English words written for this site, with your choice of separator, capitalisation or a two-digit number.
Entropy is printed from your settings: length times log2 of the pool size for passwords, and words times log2 of the list size for passphrases. The "one of each set" rule lowers a password figure very slightly, so read it as "about".
Worked example
Password, default settings pool = 26 + 26 + 10 + 27 = 89 characters length = 20 bits = 20 x log2(89) = 20 x 6.48 = about 129.5 Passphrase, 5 words list = 1,170 words, log2(1170) = about 10.19 bits each bits = 5 x 10.19 = about 51.0 (6 words: about 61.2)
These are the numbers the tool prints. They assume an attacker knows exactly how the secret was made and still has to guess it.
Password or passphrase: which should you use?
For accounts kept in a password manager, a long random password is easiest: nothing to memorise. For the few secrets you must type or remember, such as a password manager master password, a passphrase is easier. Each extra word adds about ten bits. A passphrase is only strong when software picks the words at random. Words you choose yourself, quotes and lyrics are much easier to guess than the figure suggests.
Habits that matter more than the generator
- Use a different password for every site. Reuse turns one breach into many.
- Store them in a password manager, not a notes file.
- Turn on two-factor authentication where offered.
- Length beats complexity. NIST's current guidance (SP 800-63B-4, checked 2026-11-08) says services should not impose composition rules, should accept at least 64 characters, and must require at least 15 characters when a password is the only login factor. See the NIST text.
- Check site rules. If a site refuses a password, untick symbols or shorten it.
Entropy says nothing about whether a site stores your password safely.
Frequently asked questions
Is the password sent anywhere?
No. It is generated by JavaScript on this page with your browser's crypto.getRandomValues and shown on screen. The page does not transmit or save it. If you copy it, it goes to your clipboard, which other software on your device may be able to read.
Is it really random?
It uses the secure random generator your browser exposes, with rejection sampling to avoid bias, and the code is covered by automated tests. No online tool can prove its output to you, so consider your own threat model.
Where does the word list come from?
It is a list of 1,170 short everyday English words written for this site and not copied from another published list. Each word adds log2 of the list size in bits.
How long should my password be?
Longer is better. NIST requires services to demand at least 15 characters when a password is the only factor. For a random mixed password, 16 to 20 characters is a comfortable choice. For passphrases, use at least five words, six for important secrets.
What does exclude lookalikes do?
It removes characters that are easy to confuse when reading or typing, such as I, l, 1, O, 0, o and some quote marks. This slightly reduces the pool and the entropy per character.
Does the generator guarantee every character type appears?
Yes. For each set you tick, at least one character from it is included. This lowers entropy by a negligible amount.