How to generate a password
- Choose a random password or a memorable passphrase.
- Set the length, 16 characters or more for a password, five words or more for a passphrase.
- Adjust the character sets if a site rejects certain symbols.
- Press Generate and check the entropy figure.
- Copy the result straight into your password manager, not into a note.
What this generator does
- Cryptographic randomness from the browser, never Math.random.
- Rejection sampling so every character is equally likely, with no modulo bias.
- Passphrases built from a word list, which are far easier to type and remember.
- An honest entropy figure in bits rather than a vague strength meter.
- Lookalike characters excluded by default, which matters when reading aloud.
- Nothing stored, nothing transmitted, nothing logged.
Length beats complexity
The rules most sites enforce. One uppercase, one digit, one symbol, were designed for a world where people picked their own passwords, and they mostly produce predictable results. Everyone capitalises the first letter, appends a number at the end and uses an exclamation mark.
What actually determines strength is entropy, measured in bits, and length contributes to it far more than variety does. A 20-character lowercase-only password has about 94 bits of entropy. A 10-character password using every character type has about 65. The longer, simpler one is roughly a billion times harder to guess.
Reading the entropy figure
- Under 40 bits: weak. Crackable quickly with commodity hardware.
- 40 to 60 bits: reasonable for low-value accounts.
- 60 to 80 bits: strong. Suitable for most things.
- Above 80 bits: very strong, and appropriate for a password manager's master password.
Each additional bit doubles the work required to guess. That is why the jump from 60 to 80 bits is not a 33 per cent improvement but a million-fold one.
Passphrases
A passphrase of five random words has roughly 55 bits of entropy and can be typed on a phone keyboard without swearing. Six words takes it past 65. The critical word is random, words you choose yourself are drawn from a much smaller pool and the entropy collapses.
They are the right choice for anything you have to type manually and often: a device unlock code, a disk encryption passphrase, or the master password for a password manager. For the hundreds of site logins that a manager fills in for you, random characters are better because you never type them.
Where the randomness comes from
This generator uses the browser's cryptographic random number generator, which draws on the operating system's entropy pool. It also uses rejection sampling rather than a simple remainder, because taking a random number modulo an alphabet size makes some characters slightly more likely than others, a subtle bias that measurably weakens output at scale.
Generators built on Math.random are unsuitable for anything security-related. Its output is predictable given enough samples, and it was never designed for secrets.
What to do with the password
Put it straight into a password manager. The single biggest improvement most people can make is not stronger passwords but different ones for every site, credential stuffing, where an attacker takes a password leaked from one breach and tries it everywhere, is the most common route into an account.
Turn on two-factor authentication wherever it is offered; it defeats a stolen password entirely. And never send a password over the same channel as the account it belongs to. Nothing generated here is stored or transmitted, close the tab and it is gone, which is why you should copy it before you do. The UUID generator uses the same random source for identifiers.