Password Generator
Make strong random passwords. You set the length and the character sets. Passwords are made in your browser and go nowhere.
How it works
- Choose the random password tab or the memorable phrase tab.
- Set the length and the character sets.
- Copy the password you like and save it in your password manager.
Why this tool
- Length from 8 to 64 characters, with five options per run.
- Separate switches for upper case, lower case, digits and symbols.
- An option to remove look alike characters (0 O 1 l I).
- A memorable word phrase from an English or Turkish word list.
- An entropy value in bits and a strength meter.
Password strength comes from length and alphabet size. The measure is entropy in bits. The formula is simple: length times the base-2 logarithm of the alphabet. With lower case, upper case, digits and symbols on, the alphabet is about 82 characters, so each character carries about 6.4 bits. Twelve characters give 77 bits. Sixteen give 103 bits. Twenty give 128 bits.
What do these numbers mean? Below 60 bits is weak against current hardware. Eighty bits is enough for most accounts. Above 100 bits stays safe for a long time. That is why the default length here is 20 characters.
One question comes up often: is it safe to make a password on a web page? Here it is, because the work happens inside your browser. The crypto.getRandomValues function reads the cryptographic random source of your operating system. The password is not sent to a server, it is not stored and no network request is made. It leaves memory when you close the page. Open the network tab and check it yourself. You can also turn off your internet connection and keep using the page.
The memorable phrase option makes a different trade. Four random words give about 35 bits. That is weaker than a random password but you can remember it. Use it in the one place you must remember: the master password of your password manager. Make random passwords for everything else and store them in that manager.
Frequently asked questions
Are the passwords really random?
Yes. The tool uses the crypto.getRandomValues function of your browser. That reads the cryptographic random source of your operating system. It is not predictable like Math.random.
What does entropy mean?
It is the uncertainty of the password in bits. It comes from the length and the alphabet size. Below 60 bits is weak, 80 bits is good and above 100 bits is strong.
How many characters are enough?
With all four sets on, 16 characters give about 103 bits, which is more than enough for most accounts. Use 20 characters for important accounts.
Is a word phrase safe?
Four words give about 35 bits and six words give about 52 bits. A number and a capital raise it a little. It is easy to type but weaker than a random password.
Are the passwords stored?
No. They are made in your browser. They are not sent to a server and not saved in the browser. They are gone when you close the page.
Where should I keep the password?
In a password manager. Make a separate password for each account. Never use one password twice, because a single leak then opens everything.