Password generator

How to use it

1. Set the length; 16 or more is a good default.
2. Choose the character sets, and skip look-alike characters if you will type it by hand.
3. Press New for another one; the strength in bits stays the same for the same settings.
4. Copy it straight into your password manager.

Where the randomness comes from

Every character is drawn with crypto.getRandomValues, the cryptographic random number generator your browser exposes to pages — the same source it uses for TLS session keys. It is never Math.random, which is a fast pseudo-random sequence meant for animations and is not safe for secrets. The draw is also done without modulo bias: an alphabet of 94 characters does not divide evenly into 256, and a generator that takes a byte modulo 94 makes the first 68 characters half again as likely as the rest.

What the strength figure actually measures

The bits shown are the size of the alphabet, raised to the length, as a power of two — how many guesses an attacker who knows exactly how the password was made would need on average. It is a property of the settings, not of the particular string, which is why it does not change when you press New. A 16-character password from all four sets is about 104 bits, which is out of reach of any offline attack; 12 lowercase letters is 56 bits, which a modern GPU rig gets through in days. Length does more than symbols do: adding four lowercase letters adds 19 bits, and turning on symbols adds about 8.

Nothing leaves this page

There is no request behind this tool. The password is generated in your browser and exists only in it until you copy it somewhere. That is also why there is no “email me this” field here: a password sent through mail is a password stored in plain text on at least two servers you do not control. Put it straight into a password manager instead.