Password Generator
Random passwords, word-based passphrases and PINs from your browser’s cryptographic random generator. Each one shows its entropy and a rough crack time. Nothing is sent or stored.
How the passwords are made
Every character, word and digit is chosen with crypto.getRandomValues, the browser’s cryptographically secure random number generator. Choices are made by rejection sampling, so no character is more likely than another. A plain random % n would make some characters slightly more likely.
Entropy is the number of equally likely possibilities, in bits. A 20-character password from a 90-character pool has about 130 bits. Each extra bit doubles the work for an attacker. The crack time assumes an offline attack at 10 billion guesses per second and that the attacker knows exactly how the password was generated. That is the worst case, so real-world odds are usually better.
Passphrases pick words at random from a built-in list of 1,645 common English words, about 10.7 bits per word. Five words give roughly 53 bits and six give about 64, and they are much easier to type or remember than a random string of the same strength.
Questions
Is a generated password sent or saved anywhere?
No. Passwords are generated in your browser and never leave the page. Only your settings, such as length and character types, are remembered on this device. The passwords themselves are not.
How long should a password be?
For accounts protected by a password manager, 16–20 random characters is plenty (100+ bits). For something you must type or remember, such as a master password or disk encryption, use a passphrase of 6 or more words.
Are passphrases really as secure as random passwords?
They can be, as long as the words are chosen at random rather than by you. Security comes from the size of the word list and the number of words. Six random words from this list (about 64 bits) are stronger than a random 9-character password (about 58 bits).
Why exclude look-alike characters?
Characters such as O and 0, or l, I and 1, are easy to misread when you copy a password by hand or read it aloud. Excluding them makes the pool a little smaller, so add a character or two of length to make up for it.
How secure is a 6-digit PIN?
A 6-digit PIN has only a million combinations (about 20 bits). That is fine where the device locks after a few wrong attempts, as phones and bank cards do. It is never safe as a password for anything that can be attacked offline.