People are bad at inventing randomness. Passwords made up on the spot follow patterns, such as a capital first letter, a word, a year and an exclamation mark, and cracking tools try those patterns first. A generator removes the human from the process: every character or word is drawn by a secure random number generator, so the only way to find the password is to guess through the whole space.
This page offers two kinds of secret. A password mixes letters, digits and symbols and suits anything stored in a password manager. A passphrase strings together common English words and suits the few secrets you must remember and type yourself, such as the master password for that manager or a computer login.
What the entropy number means
Strength is measured in bits of entropy: the base-2 logarithm of how many equally likely results the generator could have produced. For a random password it is length × log2(pool size). With all four character types switched on, the pool has 87 characters (26 lowercase, 26 uppercase, 10 digits and 25 symbols), worth about 6.4 bits each, so the default 16-character password carries about 103 bits. Each extra bit doubles the number of guesses needed; 80 bits already means around 1.2 × 10^24 possibilities, which would take tens of thousands of years at a trillion guesses per second.
A passphrase is measured the same way, per word instead of per character. The built-in list has 2,688 words, so each word adds about 11.4 bits: 5 words give about 57 bits, 7 words about 80 and 10 words about 114. The calculation assumes the attacker knows exactly how the secret was made, which is the honest assumption. It only holds for secrets generated randomly, not for ones you edit afterwards.
Which option to use
Accounts in a password manager
If the manager fills the password for you, use the Password type at 16 to 20 characters with every character type on.
Secrets you type from memory
For a master password, a disk encryption key or a laptop login, choose Passphrase with 6 or more words. Something like orbit-candle-meadow-fossil-ticket-velvet is far easier to type correctly than 16 random symbols and can be just as strong.
Codes read aloud or copied by hand
For Wi-Fi keys or temporary passwords shared over the phone, turn on Exclude look-alike characters so nobody confuses a capital I with a lowercase l or the letter O with zero.
How the generator works
All randomness comes from crypto.getRandomValues, the browser's cryptographically secure generator. Characters are chosen by rejection sampling, which avoids the small bias a simple modulo operation would introduce, and when Include at least one of each selected type is on, one character from every chosen set is placed first and the whole result is then shuffled with an unbiased Fisher-Yates shuffle, so the guaranteed characters do not sit in predictable positions.
Exclude look-alike characters removes I, l, 1, O, 0 and also lowercase o, shrinking the full pool from 87 to 81 characters. In Passphrase mode, Capitalize words and the Separator only change presentation and add no entropy, because they are applied to every word in the same way. Add a number appends a value from 0 to 99 to one randomly chosen word, which adds about 9 bits to a five-word phrase. The meter labels results under 40 bits Weak, under 60 Fair, under 80 Good, under 110 Strong, and 110 or more Excellent.
Comment utiliser cet outil
- Choose Password or Passphrase under Type.
- For a password, drag Length and switch Lowercase, Uppercase, Numbers and Symbols on or off. For a passphrase, set the number of Words, the Separator and the optional switches.
- Check the Strength label and the Entropy value in bits. A new result appears every time you change a setting.
- Press Regenerate until you get one you like, then press Copy and save it straight into your password manager.
Limitations
- Passwords run from 4 to 128 characters; passphrases from 3 to 10 words, with a separator of up to 3 characters.
- The word list is English only and the symbol set is fixed. You cannot add custom characters or your own word list.
- Nothing is saved, and there is no history. Once you leave or regenerate, the previous result is gone, so copy it before you move on.