How to use it
- Choose the mode: Password (random characters) or Passphrase (several words joined by a separator).
- Set the length with the slider and tick the sets you want: lowercase, uppercase, digits, symbols. The symbol set itself is editable, to match what a particular site accepts.
- Turn on exclude look-alikes (
0O1lI|), no repeats in a row or start with a letter if you are up against a fussy signup form. - Press Generate (or Ctrl/Cmd+Enter) and copy the result. Below it: the entropy in bits, a one-word verdict, and the time a full search takes at 1010 guesses per second.
- Need many at once — set the count (up to 1000) and press Generate a batch. The list copies in one click or downloads as
.txt.
How the generator works
Every character is drawn through crypto.getRandomValues, the browser cryptographic generator — the same source a password manager uses. Math.random is not involved, and the modulo bias is removed, so each character of the set comes up equally often. With several classes ticked, the password is guaranteed to hold at least one character from each: generation repeats until that holds, and the uniformity survives it.
Nothing goes to a server, so you can cut the connection and keep generating. Local storage holds your settings only — the passwords themselves are written nowhere.
What entropy is, and how to read the verdict
Entropy measures how unpredictable a password is, in bits: log₂(set size) × length. Twelve characters out of a 94-character set is about 79 bits; a five-word passphrase from a 250-word list is about 40 bits, plus the number. The crack time assumes an attacker checking ten billion candidates per second, which is a few strong GPUs against a fast hash such as MD5 or NTLM. Against bcrypt or Argon2 the real rate is thousands of times lower, so the estimate here is the pessimistic one.
| Bits | Verdict | Example |
|---|---|---|
| under 40 | weak | 8 characters in one letter case |
| 40–59 | fair | 8 characters of every class, 10 lowercase with digits, a 4 to 6 word phrase |
| 60–99 | strong | 12 to 15 characters of every class, a 7 to 10 word phrase with a number |
| 100 and up | very strong | 16 characters or more, every class |
Password or passphrase
A random string like k7#Qv!2pRz9$ is strong per character and impossible to remember — those live in a password manager. A passphrase like maple-river-stone-orbit-42 is longer but sticks after one reading, which makes it the right choice for the master password of a manager, for disk encryption, or for Wi-Fi. For working accounts — ad platforms, affiliate networks, exchanges — the batch mode is the shortest path: one unique password per account, all of them into the manager.
Options for fussy forms
- Exclude look-alikes drops
0 O 1 l I |, which helps when the password gets dictated over the phone or typed off paper. - No repeats in a row forbids
aaand77; some banks and hosting panels reject those. - Start with a letter is a requirement of some legacy systems and login fields where the first character cannot be a digit or a sign.
- The symbol set is editable: remove the quote and the backslash if a site refuses them, or leave only
-_.for a URL-safe value.
Questions
How safe is an online password generator?
This one is entirely local: generation runs in your browser through WebCrypto, the page makes no network requests and keeps no results. The Network tab in DevTools will confirm it.
How long should a strong password be?
For an account behind two-factor authentication, 12 to 14 random characters across all classes is enough, which is around 80 to 90 bits. For a password manager master key, disk encryption or a crypto wallet: 16 characters and up, or a passphrase of 6 to 8 words.
What are bits of entropy?
The number of equally likely candidates an attacker has to work through, as a power of two. Each extra bit doubles the search; 40 bits is minutes on a GPU, 80 bits is millions of years.
Can I generate many passwords at once?
Yes — the batch block produces 1 to 1000 passwords with the current settings. The list copies in one click or downloads as a .txt file, one password per line.
Why is there no letter O or digit 0 in my password?
The exclude look-alikes option is on: it removes 0O1lI| so the password cannot be misread. Untick it and the full set comes back.
