Password Generator

Generates random passwords or memorable passphrases using your browser’s cryptographic random generator. Choose the length and character types, copy, done – the passwords never leave your device.

How it is calculated

A good password is above all random and long. This generator uses your browser’s Web Crypto function crypto.getRandomValues() – the same cryptographically secure randomness used for encryption. Each character is drawn without modulo bias (rejection sampling).

At least one character of each type – without bias

Many generators place one fixed character per selected type and then shuffle the result. That favors small groups such as digits. Here, a candidate is instead drawn completely at random and rejected whenever a selected character type is missing. That way every valid password is exactly equally likely.

Entropy: how much randomness is in it?

Entropy in bits is the base-2 logarithm of the number of possible outcomes. Example: 16 characters out of 90 possible characters (A–Z, a–z, 0–9, 28 special characters) give 16 × log₂(90) ≈ 103.9 bits; the rule “at least one of each selected type” rules out some combinations and costs about 0.26 bits – calculated exactly with inclusion-exclusion, so the figure shown is ≈ 103.6 bits. Every extra bit doubles the effort needed to try every possibility.

Passphrase: memorable yet strong

A passphrase consists of randomly chosen words, for example ladder-tobacco-moon-tile-rudder-basket. With 7,776 words, each word contributes log₂(7,776) ≈ 12.9 bits, so six words give ≈ 77.5 bits. The German Federal Office for Information Security (BSI) explicitly names 5–6 random words as a good method. The word list used here is the EFF Large Wordlist (CC BY). Important: only randomly chosen words are secure – a phrase you make up yourself is far easier to guess.

Recommendations

BSI (German Federal Office for Information Security): 8–12 characters with four character types, or 20–25 characters with two character types; Wi-Fi keys at least 20 characters.
NIST SP 800-63B: at least 15 characters if the password protects the account on its own; at least 8 characters only when combined with a second factor.
Use a separate password for every account – a password manager makes this easiest.

Frequently asked questions

Are the generated passwords stored anywhere?

No. They are created only in your browser, never sent, never stored, and never written to the address bar. Reload the page and they are gone.

How long should a password be?

For a random password, 16 characters using all character types (≈ 104 bits) is plenty. NIST requires at least 15 characters if no second factor is used. For passphrases, the BSI recommends 5–6 random words.

What does “bits” mean for entropy?

The number of bits tells you how many equally likely possibilities there are: 2 to the power of the bit count. 80 bits are about 1.2 septillion possibilities – at ten billion attempts per second, trying them all would take millions of years.

Why skip look-alike characters?

I, l, 1 and |, O, 0 and o are hard to tell apart in many fonts. Leaving them out makes a password easier to type correctly. This lowers the entropy slightly – the display accounts for that.

Is a passphrase as secure as a random password?

Yes, if the words are truly chosen at random: six words from 7,776 (≈ 77.5 bits) correspond to about 12 random characters from A–Z, a–z and 0–9 (≈ 71.5 bits). With seven words (≈ 90.5 bits) you are clearly above that.

Sources and legal basis

As of: 27 September 2026