Secure Password Generator

Choose Password for a random string of characters or Passphrase for a sequence of randomly selected words.

For passwords, set the length and choose which character types to include. For passphrases, set the number of words and a separator.

Select Generate to create a new result. Open Advanced options to exclude visually similar characters, capitalize passphrase words, or generate 5 or 10 results at once.

Use Copy to transfer a result to a trusted password manager. If a service rejects it, check the service's accepted length and characters before changing the settings.

Password mode draws characters from the selected lowercase, uppercase, number and symbol pools. With all four enabled, the pool contains 86 ASCII characters.

Each generated password contains at least one character from every enabled pool. The generator selects complete candidate strings uniformly and discards any candidate that misses a required set; it does not insert a predictable character at a fixed position.

The optional ambiguity filter removes I, l, 1, O, 0 and o. This is useful when reading a password from another screen or entering it by hand, but it slightly reduces the available character pool.

Longer passwords generally offer a much larger search space. A service's own length and symbol restrictions still determine what it will accept.

Passphrase mode uses the Electronic Frontier Foundation's long wordlist of 7,776 entries. It independently selects each word with secure browser randomness; the same word can appear more than once.

The default is six words, following EFF's guidance for its long list. Four through twelve words are supported, though fewer words leave a smaller search space.

Hyphens, spaces, periods and underscores are presentation choices between words. Capitalizing every word is also a formatting choice. None of these settings adds random bits because they are applied predictably.

Wordlist credit: Electronic Frontier Foundation, EFF Dice-Generated Passphrases (https://www.eff.org/dice). EFF publishes its original website material under a Creative Commons Attribution license (https://www.eff.org/copyright).

The number shown in bits is the base-2 logarithm of the number of outputs possible under the current settings. It is not a security grade, a breach check or an estimate of how long an attack will take.

For passphrases, each independently selected word has 7,776 possibilities. Six words therefore give 7,776⁶ possible ordered sequences, or approximately 77.5 bits. Choosing a different fixed separator does not change that figure.

For passwords, the calculation accounts for the requirement that every enabled character set appear at least once. It does not overcount strings missing one of those sets.

The examples below describe the configured output space, not the resistance of an account to phishing, malware, online rate limits or password-database theft.

The generator calls the browser's crypto.getRandomValues API instead of Math.random. It discards out-of-range 32-bit random values before mapping them to characters or words so that each possible choice is equally likely.

Password mode also rejects complete candidates that lack a selected character category. Among all results meeting the chosen conditions, each valid string has the same probability.

If secure browser randomness is unavailable, generation fails rather than silently switching to a weaker source.

Use a distinct password or passphrase for each account. For ordinary sign-ins, a long random password saved in a password manager is usually easier to handle than one you must memorize.

A multiword passphrase is useful when you need something you can remember and type, such as a password-manager unlock phrase, provided the destination accepts its length and characters.

NIST's current guidance emphasizes length and advises services not to impose mandatory character mixtures on user-chosen passwords. The character controls here are for matching the requirements of individual services, not because every password must contain symbols.

A generated password does not prevent phishing or an infected device from stealing it. Use phishing-resistant authentication or multifactor authentication where available.

Generation runs in the browser, and this tool has no account, password-history feature or breach-database lookup. The passphrase wordlist is loaded from the site's own bundled code on first use, not requested from EFF while generating.

Generated results are displayed on the page and can be revealed or hidden. Hiding a result only masks its display; it does not remove the value from the page's memory.

Copying sends the selected text to the device clipboard, where it may remain accessible to clipboard history, synchronization software or other applications. The tool cannot control those systems.