Password Generator

1. 1Choose between a random password and a word-based passphrase.
2. 2Set the length and which character types to include.
3. 3Turn on the ambiguous-character filter if you will be typing the password by hand.
4. 4Copy the result, or generate a batch if you need several.

Randomness comes from crypto.getRandomValues(), the browser's cryptographically secure generator, which is seeded by the operating system's entropy pool. This matters: Math.random() is fast but predictable enough that an attacker who sees a few outputs can work out the rest, which makes it unsuitable for anything secret.

Characters are selected using rejection sampling rather than a simple modulo, because modulo introduces a slight bias toward the start of the character set. Rejection sampling discards values that would skew the distribution, so every character is genuinely equally likely.

The strength figure shown is entropy in bits — log₂ of the number of possible passwords of that length and character set. It measures how many guesses an attacker needs on average, and it is the honest way to compare two passwords. A 16-character password from the full set is about 105 bits, which is beyond brute force by any realistic margin.

Passphrases trade length for memorability. Four random words from a large list give roughly 52 bits — weaker than a long random string but far stronger than anything a person invents, and much easier to type on a phone.

Nothing generated here is transmitted, logged or stored. Closing the tab is the end of it.