Password Generator

Create a random password or a memorable passphrase. Adjust the settings to match the account’s requirements, then copy your result. Passwords are generated in your browser — this tool does not save or send your generated passwords.

How to use it: choose Random password or Memorable passphrase. For passwords, set the length (8–128 characters) and character categories (uppercase, lowercase, numbers, symbols), optionally excluding confusing characters or trimming the allowed-symbol set. For passphrases, set the word count (3–10 words), separator, capitalization and an optional random digit. Press Generate another until you like the result, then press Copy. Paste it into the account (or better, save it in a password manager) — then clear or leave the page.

Random passwords versus memorable passphrases: a random password packs the most guessing resistance into the fewest characters, which suits logins with strict length limits. A passphrase of six random words is longer to type but easier to read and remember, which suits a master password or a code you must enter by hand. Both are strong here because both are chosen uniformly at random — strength comes from the size of the output space, not from looking complicated.

Why length and random selection matter: every extra character (or word) multiplies the number of possible outputs, so guessing gets exponentially harder while typing gets only slightly longer. That only holds when selection is truly random: this tool draws from your browser’s cryptographic random generator (crypto.getRandomValues()) with rejection sampling, so no outcome is favoured. Published guidance says the same — NIST’s digital-identity guidelines (SP 800-63B) emphasize longer memorized secrets, and MDN documents the Web Crypto API this tool is built on.

Matching website requirements, unique passwords and managers: some sites reject spaces, cap the length, or require (or forbid) particular symbols — shorten the length or switch off the offending category and generate again, keeping the length as high as the site allows rather than reusing an old password. Give every account its own generated result: reusing one password means one leaked database unlocks everything. A password manager remembers long, unique results so you don’t have to — save each result when you create the account, lock the manager with a strong passphrase, and turn on two-factor authentication where it is offered.

How results are generated and privacy limits: random passwords sample uniformly from the combined permitted pool (printable ASCII letters, digits and symbols, minus your exclusions) and resample until every enabled category appears at least once — bounded at 1,000 attempts, with a clear failure instead of weaker randomness. Passphrases pick each word independently and uniformly from the locally bundled EFF large word list (7,776 words; repeats allowed); the single appended digit, when enabled, goes at the end. Word list credit: Electronic Frontier Foundation, “EFF Large Wordlist for Passphrases” (eff.org), used under a Creative Commons Attribution license — words are bundled with this page, never fetched from a server. No Web Crypto means no generation: the tool shows an error and disables its buttons rather than falling back to insecure randomness. Nothing is embedded in server HTML, and this page creates no sharing links, history, uploads, breach checks, or exports. Client-only generation cannot protect results from a compromised device, a malicious browser extension, or another script on this page — keep those trusted, and clear results when done. Clearing removes the tool’s references; it cannot erase all browser memory or the system clipboard. Strength estimates resistance to guessing only (Weak below 50 bits, Fair 50–79, Good 80–111, Strong 112+).