Password & Passphrase Generator
Generate strong passwords and passphrases with entropy-based strength scoring.
100% in your browser — files never leave your device
How password and passphrase generation work
Every character comes from crypto.getRandomValues, the browser's cryptographically secure random source — not Math.random, which is not safe for anything security-sensitive. Selection also avoids modulo bias: instead of taking a random number mod the pool size (which very slightly favors low values), it rejects out-of-range draws and retries, so every character in the pool is equally likely.
The strength estimate is entropy in bits, computed from what's actually in the password: it detects which character classes you used (lowercase, uppercase, digits, symbols) and multiplies the pool size by the length. Passphrase entropy is log2 of the actual word-list size per word — this tool's list has 199 words, so each word contributes about 7.6 bits, not a marketing number picked to look impressive.
Entropy estimates assume an attacker knows exactly how the password was generated but not the random draws themselves — the standard assumption in password security. They say nothing about reused passwords, phishing, or a compromised device; a high entropy score doesn't make a password immune to those.
Frequently asked questions
How is entropy calculated?
For random passwords, entropy = length × log₂(pool size), where pool size depends on which character sets are active. For passphrases, entropy = word count × log₂(word list size). Higher entropy means more guessing work for an attacker.
Is my password sent anywhere?
No. Generation uses the browser's crypto.getRandomValues API entirely in your browser. Nothing is transmitted or logged.
How large is the built-in word list for passphrases?
The word list has 199 words, giving roughly 7.6 bits of entropy per word. A 5-word passphrase from this list has ~38 bits — well above the "Strong" threshold.