What this password generator does
This tool creates strong random passwords and memorable passphrases right in your browser. Pick character classes and length, or switch to passphrase mode and string together random words from the EFF wordlist. A live entropy meter shows how hard the result would be to guess, and a single click copies it to your clipboard.
Why random passwords matter
The most common way accounts get compromised is reused or guessable passwords. If one service leaks your password and you used it elsewhere, attackers try it everywhere. A long, random, unique password per account removes that risk — and a generator is the only practical way to create one you would never invent yourself.
How the strength meter works
Strength is measured in bits of entropy, an estimate of how many guesses an attacker would need. Each extra character and each extra character type multiplies the possibilities:
| Entropy | Rating | Rough meaning |
|---|---|---|
| under 40 bits | weak | crackable quickly |
| 40–60 bits | fair | okay for low-value logins |
| 60–80 bits | strong | good for most accounts |
| 80+ bits | very strong | suitable for high-value accounts |
The fastest way to raise entropy is length: a longer password beats a short one with more symbol types almost every time.
Password or passphrase — which should you pick?
A passphrase strings together randomly chosen words: acorn.tiger.bonus.cider.wolf. The
principle is called Diceware, and the words here come from the EFF short wordlist
published by the Electronic Frontier Foundation in its 2016 article “Deep Dive: EFF's New
Wordlists for Random Passphrases” — 1,296 words (6⁴, four dice rolls), each at most
five characters, curated for memorability and published under CC BY 3.0. Every uniformly
drawn word contributes log₂(1296) ≈ 10.3 bits of entropy, so five words reach about
52 bits and seven about 72 — the meter shows the exact figure, calculated the same honest
way as in character mode.
Pick a passphrase when you have to memorize or type the secret yourself: a master password, a Wi-Fi key, disk encryption. Pick a random character password for everything that lives in a password manager anyway. One honest limitation: the wordlist is English only, because the EFF documents its curation and license while we found no German list with comparable provenance — random selection, not the words' language, is what makes a passphrase strong. Capitalizing the words is pure readability and adds no entropy, so the meter does not count it; the optional trailing digit is drawn randomly and honestly adds just over 3 bits — no more, because its position is fixed.
Secure by design
Passwords and passphrases are generated with your browser's cryptographic random
number generator (crypto.getRandomValues) using rejection sampling, so there is no
statistical bias toward certain characters or words. Nothing is sent to a server, nothing
is logged, and generated passwords are never stored — only your preferences (mode,
length, character sets, word count) are remembered locally.
Tips for everyday use
- Use a unique password for every account — never recycle one.
- Store them in a password manager so you do not have to remember them.
- Turn on two-factor authentication wherever it is offered.
- Exclude ambiguous characters (l, I, 1, O, 0) if you will read or type the password by hand.
- For passphrases you must memorize, prefer length over complexity.