Password Generator

How to use

1. Choose the length (4–64) with the slider
2. Check the kinds of characters to use (uppercase, lowercase, digits, symbols)
3. If the service rejects some symbols, delete them from the "Symbols to use" field
4. Check "Exclude look-alike characters" if you plan to copy the password by hand
5. Enter how many passwords you want (1–20) and press "Generate"
6. Use "Copy" on a row to copy one password, or "Copy all" to copy every password on separate lines

For a password you will memorize and type by hand, choose "Passphrase of words" under "Format" at the top to join English words into a passphrase instead. See "Making a passphrase" below.

The app starts with "Random characters" as the format, a length of 16, all four kinds checked, all 32 symbols in "Symbols to use", and a count of 1. Changing the length, the kinds of characters, the symbols to use, or the look-alike setting removes the displayed passwords, so that the strength estimate always describes the current settings. Press "Generate" again.

Passwords are generated with the browser's crypto.getRandomValues(); there is no server communication.

Example

With a length of 16 and all four kinds checked, pressing "Generate" produces a password like:

t7#Lq9@vZ2!mXw4&

(The value changes randomly each time.)

The strength estimate then reads "Strong (about 104 bits)".

Characters used

• Uppercase: the 26 letters A to Z
• Lowercase: the 26 letters a to z
• Digits: the 10 digits 0 to 9
• Symbols: these 32 characters

!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~

Selecting all four kinds gives 94 characters. Spaces, full-width characters, and non-English letters are never used.

Checking "Exclude look-alike characters" removes I and O from uppercase, l and o from lowercase, 0 and 1 from digits, and | from symbols, which leaves 87 characters across all four kinds.

Narrowing the symbols

While "Symbols" is checked, a "Symbols to use" field appears below it. It starts with all 32 characters above, and only the symbols in this field are used.

• If the service rejects a few symbols, delete them from the field
• If the service names the symbols it accepts, such as "only !@#$%", clear the field and type or paste those symbols
• "Restore all symbols" puts the 32 characters back

The field is read as follows.

• Characters outside the 32 above (spaces, letters, digits, full-width symbols, non-English letters) are ignored
• A symbol written twice counts once, and the order you write them in does not affect the result
• , and : are symbols too. Pasting a separated list such as !, @, # also adds , to the symbols to use, so delete the separators

The line under the field shows how many symbols are actually used. | is not counted while "Exclude look-alike characters" is checked.

When no usable symbol is left (the field is empty, it holds only non-symbols, or it holds only | with look-alikes excluded), the app says so in place of the strength estimate and "Generate" cannot be pressed. Enter a symbol or uncheck "Symbols".

Unchecking "Symbols" hides the field but keeps what you typed, and checking it again brings the same content back. Reloading the page restores all 32.

Making a passphrase

Choosing "Passphrase of words" under "Format" replaces the length, character, symbol, and look-alike settings with these:

1. Choose the number of words (3–12) with the slider. It starts at 6
2. Under "Separator", choose what goes between the words: a hyphen (-), a space, a period (.), or an underscore (_). It starts with the hyphen
3. Enter how many passphrases you want (1–20) and press "Generate"

With 6 words and hyphens, pressing "Generate" produces a passphrase like:

emit-charbroil-suction-revision-stream-flashcard

(The value changes randomly each time.)

The strength estimate then reads "Fair (about 77 bits)".

The words come from the EFF Long Wordlist of 7,776 English words that the Electronic Frontier Foundation published for passphrases (CC BY 4.0). The four words that contain a hyphen (drop-down, felt-tip, t-shirt, yo-yo) are left out, leaving 7,772. That way, whichever separator you choose, splitting a passphrase at the separator gives back its words in only one way.

• Every word is 3 to 9 lowercase letters a to z
• Each word is picked from the 7,772 without favoring any of them. The same word can appear more than once
• The app does not capitalize words or add digits or symbols. If the service requires uppercase letters, digits, or symbols, use random characters instead

Changing the number of words, the separator, or the format removes the displayed passphrases. Switching back to "Random characters" keeps the length, kinds of characters, and other settings as you left them.

How a password is generated

1. One character is picked from each checked kind
2. The remaining positions are filled one character at a time from all the checked kinds combined
3. The whole password is then shuffled, so the characters picked per kind do not stay at the front

When a character is picked, random values in the range that would favor some characters are discarded and drawn again, so the remainder after dividing by the number of characters is not biased. When several passwords are requested, the same steps are repeated independently for each one.

How the strength estimate is calculated

The app calculates the entropy in bits of the passwords its own steps produce and shows it rounded down to a whole number.

If every position were drawn freely from the usable characters, the entropy would be "length × log2(number of usable characters)". Using all four kinds gives 94 characters, or about 6.55 bits per character and about 104.87 bits at length 16. In practice each selected kind must appear at least once, which makes the results slightly less varied, so the value is a little lower. The figure shown has that loss subtracted.

• With a single kind selected, nothing is lost
• With all four kinds (94 characters) at length 16, about 0.37 bits are lost, leaving about 104.50 bits
• A kind with few characters loses more. With the symbols narrowed to ! alone at length 17, "17 × log2(63)" is about 101.61 bits, but subtracting what the guaranteed ! costs leaves about 99.35 bits, which reads "Fair"

The ratings are:

• Under 60: Weak
• 60 to under 100: Fair
• 100 or more: Strong

Passphrases use the same ratings (see "Passphrase strength" below).

The estimate reads as follows for common settings.

• All four kinds (94 characters): about 51 bits at length 8 (Weak), about 78 bits at length 12 (Fair), about 104 bits at length 16 (Strong). "Fair" from length 10, "Strong" from length 16
• All four kinds with the symbols narrowed to the five characters !@#$% (67 characters): about 96 bits at length 16 (Fair). "Strong" from length 17
• Uppercase, lowercase, and digits (62 characters): about 71 bits at length 12 (Fair), about 95 bits at length 16 (Fair). "Fair" from length 11, "Strong" from length 17
• Lowercase and digits (36 characters): about 82 bits at length 16 (Fair). "Fair" from length 12, "Strong" from length 20
• Digits only (10 characters): about 26 bits at length 8 (Weak). "Fair" from length 19, "Strong" from length 31

Passphrase strength

The entropy of a passphrase is "number of words × log2(7,772)", about 12.92 bits per word. Each word is picked independently, so nothing is lost as it is for random characters. The separator is one fixed character, so the choice does not change the value. The figure holds even for someone who knows the word list and the number of words: that is how many combinations they would have to try.

• 3 words: about 38 bits (Weak)
• 4 words: about 51 bits (Weak)
• 5 words: about 64 bits (Fair)
• 6 words: about 77 bits (Fair)
• 7 words: about 90 bits (Fair)
• 8 words: about 103 bits (Strong)
• 12 words: about 155 bits (Strong)

"Fair" from 5 words, "Strong" from 8 words.

Things to keep in mind

• The strength estimate is calculated only from the length and the number of characters in each selected kind (for a passphrase, the number of words and the size of the word list). It does not account for reusing a password or for a leak from wherever it is stored.
• A copied password goes to the clipboard of your device. After pasting it, copying something else over it is a sensible precaution.
• Everything runs in your browser and generated passwords are not saved. They cannot be recovered after you reload or close the page, so record them in a password manager or similar before leaving.
• Passphrase words are picked at random, so they do not form a sentence. Reordering them into something easier to remember, or swapping in words you like, makes the passphrase weaker than the estimate.

FAQ

Are the generated passwords secure?

They come from a cryptographic random source (crypto.getRandomValues()), and every character is picked so that no candidate is favored. Generated passwords are never sent to a server or stored.

Will every selected kind of character appear?

Yes. Each checked kind contributes at least one character, which makes it easier to satisfy sign-up rules such as "at least one uppercase letter, digit, and symbol".

What are "look-alike characters"?

Seven characters: 0 (zero) with O and o (letter O), and 1 (one) with l (lowercase L), I (uppercase i), and | (vertical bar). Excluding them shrinks the pool, so the strength estimate drops slightly. A | left in the "Symbols to use" field is not used while the box is checked.

How long should the password be?

With all four kinds, the initial 32 symbols in "Symbols to use", and look-alikes not excluded, 16 characters or more reads "Strong". Narrowing the symbols or excluding look-alikes can raise the length you need, so go by the strength estimate on screen. Where a service does not accept symbols, make up for it with length: letters and digits alone need 17 characters or more, and 18 or more with look-alikes excluded.

What if the service rejects some of the symbols?

Delete the rejected symbols from the "Symbols to use" field. If the service names the symbols it accepts, clear the field and enter only those. Fewer symbols lower the strength estimate, so increase the length if it drops to "Fair" or "Weak". If the service accepts no symbols at all, uncheck "Symbols".

Will every symbol I chose appear?

No. What is guaranteed is at least one of the symbols in the "Symbols to use" field. The remaining positions are drawn from all the checked kinds combined, so not every symbol in the field has to appear. A symbol that is not in the field never appears.

Should I use random characters or a passphrase?

For a password you keep in a password manager and paste, random characters are shorter. For one you memorize and type, such as a computer login or the master password of a password manager, a passphrase suits better. For similar strength the lengths differ a lot: a 16-character random password reads "Strong", while an 8-word passphrase averages about 63 characters with its hyphens. If the service limits the length, use random characters.

The same word appeared twice in my passphrase

That is expected. Each word is picked from all 7,772, so a word that already appeared can be picked again. The strength estimate already accounts for repeated words. Press "Generate" again if you prefer.

Can I generate a numeric PIN?

Check only "Digits" to generate a string of digits. The length starts at 4. For four digits the strength estimate is about 13 bits and reads "Weak".

How many passwords can I generate at once?

Up to 20, for random characters and passphrases alike. If you generate with an empty or out-of-range count, the app clamps it to 1–20, generates that many, and shows the adjusted count in the field.