Password Generator
Generate passwords or passphrases from a cryptographic source, with strength stated in bits.
About this tool
Generates random passwords and passphrases, and tells you how strong each one is in bits of entropy.
**The randomness comes from the operating system's cryptographic generator.** That matters more than it sounds. A generator built on the ordinary random function produces output that looks random and is predictable to anyone who knows roughly when it was created, because the sequence is seeded rather than random.
**Strength is given in bits, not as "weak" or "strong".** Those five-point scales score composition rules — one uppercase, one digit, one symbol — which is exactly the thinking that produced `P@ssw0rd1`. Entropy in bits is a real measure of how many guesses an attacker needs, and it says what it means. Each extra bit doubles that number.
Nothing generated here is stored or logged.
Common questions
How many bits of entropy do I need?
Under 50 is guessable by a determined attacker with modern hardware. 60 to 80 is fine for an ordinary account behind rate limiting. Above 100 for anything protecting other credentials — a password manager's master password, a signing key.
Is a passphrase as strong as a password?
It can be, and it takes more characters to get there. Four words from a thousand-word list is about 40 bits; six words is about 60. The advantage is that it can be remembered and typed, which matters for the handful you cannot store in a manager.
Are these passwords sent anywhere?
They are generated on the server and returned to your browser. They are not logged and not stored unless you are signed in and save the run. For anything genuinely sensitive, generate it in your password manager instead — nothing has to leave your machine there.
Why avoid ambiguous characters?
Only when a password will be read aloud or typed from paper, where I, l, 1, O and 0 get confused. It costs a little entropy, which a couple of extra characters covers.