Password generator

Every character or word comes from your browser’s cryptographic random number generator (crypto.getRandomValues), and each is equally likely: values that would favour some characters over others are thrown away and drawn again.

They measure how many guesses an attacker who knows these settings would need: each extra bit doubles it. 14 characters from all four sets give 90 bits; 5 passphrase words give 64, or 70 with the added number. The figure is an upper bound, because a password must contain every set you chose, which rules out a few.

Many strength meters guess from the text itself and give their top score once a guess count passes about ten billion, roughly 33 bits: enough against a website that limits login attempts, not against an offline attack on a stolen password hash. Ours counts the worst case, an attacker who knows exactly how it was made, and calls Strong from 64 bits and very strong from 80. A 5-word passphrase with a number is strong; add a word for very strong.

Use a password where a password manager fills it in. Use a passphrase for the few you type or remember, such as the password manager’s own: a few words are easier to type than random characters of the same strength.

! # $ % & ( ) * + , - . / : ; < = > ? @ [ ] ^ _ { | } ~ — ASCII punctuation without quotes, backtick and backslash, which often break when pasted into a shell or a config file.

No. Passwords are made in your browser, and the page sends no request while making them. Nothing is saved, nothing goes into the page address, and only Copy puts one on your clipboard. Passphrase words come from the EFF large word list, which the page downloads once when you choose Passphrase.