PlainwrenPassword and passphrase generator
Make a random password from letters, digits and symbols, or a passphrase of random words that is easier to remember and type. Passwords are created on your device and never sent anywhere.
How the passwords are made
Every character or word is picked with your browser's cryptographically secure random number generator (crypto.getRandomValues), the same source used for encryption keys, not the predictable Math.random. Picks are made without "modulo bias", so every character in the pool is exactly as likely as every other.
For random passwords, the generator first puts in one character from each type you ticked (so a password with digits ticked always has at least one digit), fills the rest from all ticked types, and then shuffles the result.
How strength is estimated
Strength is shown in bits of entropy: the number of yes/no guesses an attacker would need, at most, to try every possible password made the same way.
Bits = length × log2(number of possible characters)
Passphrase bits = words × log2(7,776) ≈ words × 12.9
Example: 16 characters from lower case, upper case, digits and 27 symbols is a pool of 89 characters, so 16 × log2(89) ≈ 104 bits. A 6-word passphrase is 6 × 12.925 ≈ 77.5 bits, which is about 277 possible passphrases. Each extra bit doubles the work for an attacker.
The labels used are: under 40 bits weak, 40–59 fair, 60–79 strong, and 80 or more very strong. The estimate assumes the attacker knows exactly how the password was made; it does not apply to passwords you invent yourself, which are usually far weaker than their length suggests.
Passwords or passphrases?
A random password packs the most strength into the fewest characters, which suits a password manager that types it for you. A passphrase such as cider-tumble-oxygen-wobbly-frame-lunar (an example only; do not use it) is longer but much easier to remember and type, which suits the few passwords you must enter by hand, such as your password manager's master password or your computer login. The Electronic Frontier Foundation recommends at least six words from its list.
FAQ
Is the password sent or stored anywhere?
No. It exists only in this browser tab until you close or reload it. Pressing Generate makes no network requests: the password is created on your device and never sent anywhere.
How long should a password be?
For accounts stored in a password manager, 16 or more random characters is a sensible default. If a site limits the length or the symbols allowed, turn off symbols and use more characters instead.
Should I reuse a strong password?
No. If one site leaks it, attackers try it everywhere else. Use a different password for every account.
Passphrase words come from the EFF Large Wordlist by the Electronic Frontier Foundation, used unchanged under the Creative Commons Attribution 4.0 licence. The list is stored on this site; no request is made to EFF.