Password Generator
A random password or a seven-word passphrase, made in this tab. Copy it in one tap. Nothing is sent anywhere.
Made in this tab, not on a server
A generator that runs on somebody else's server has to see the password in order to hand it back. This page does not work that way. The code arrived with the HTML. It calls crypto.getRandomValues, the browser's own cryptographic RNG, the same one the rest of the page uses for secure cookies. Open the network panel, hit Generate another a few times, and you will see no request go out. Unplug the cable. It still works.
The password is not saved. Your settings stay in this browser so you do not have to click them again tomorrow: the length, which boxes are on, random or passphrase. The password itself never joins them.
Random characters, or words you can type
The random mode starts at 20 characters from lowercase, uppercase, digits and symbols. That alphabet is 80 symbols, so 20 characters is about 126 bits. Shorten it if a site caps the length. Drop a set if the form will not take symbols. Turn on Exclude similar when you have to type the thing onto a TV and 0/O/1/l keep swapping in your head.
The other mode is a passphrase. Seven words from the EFF's public 7,776-word list, joined with hyphens. That is 90.5 bits. The comic people forward around is four common English words. Four words from this list sit at 52 bits, which is not the bar. Seven crosses the 90-bit line a Show HN post used as the target, and it is still short enough to type.
Why the bits sit next to the password
"Strong" is a mood. Bits are a count. Each extra bit doubles the number of guesses. Forty bits is a long afternoon for someone with a decent GPU. Eighty is not. The number next to the password is there so a checkbox has a cost you can see. Turning symbols off on a short password is not a small change, and the figure moves when you do it.
The bar under it is the same number, drawn. Under 40 bits it reads weak, 40 to 59 is okay, 60 to 79 is strong, and 80 and up is very strong. The seven-word default lands in very strong, which is why it is the default for that mode.
Lookalikes, and sites that want a digit
Some forms refuse a password with no number, or no symbol, or one that looks like a sentence. Random mode puts at least one character from every set you left on into the result, so a 20-character password is not accidentally all lowercase. Passphrase mode can tack a digit on the end for the forms that demand one. Capitalizing each word is there for the same kind of rule, and because some people remember Correct-Horse-Battery-Staple more easily than the lowercase version.
Exclude similar pulls i, l, 1, L, o, 0 and O out of the pool. That makes the password a little weaker, because the alphabet shrank, and a lot easier to read off a screen onto a phone. The bits number will tell you which way you went.
Common questions
Does this password ever leave my computer?
No. JavaScript in this tab generates it. After the page has loaded there is no request to any server, no account, and the password is not written to disk. Your settings stay in this browser's local storage. The password itself does not.
What does 90 bits actually mean?
It is the size of the guess space, written as a power of two. Seven words from a 7,776-word list is 7 times log2(7776), which is 90.5 bits. A machine trying a billion guesses a second would still need about 54 billion years to walk that space. That number only holds if the words were picked at random, which is what this page does.
When should I use a passphrase instead of random characters?
When you have to type it. Twenty random characters are stronger per character and miserable to enter by hand. Seven ordinary words still sit above 90 bits, and you can read them over the phone. Use random when a password manager will store it. Use a passphrase when you have to remember it.
Can I paste this into a password manager?
Yes. Generate it, copy it, paste it into the manager. Then press Generate another so this tab is no longer holding the one you saved. Close the tab if you want. Nothing of yours is sitting on a server to delete.
I wrote up why the bits sit at 90.5, and the remainder bug most generators still ship, in The Generator Never Saw the Password.
Two more that also run in the tab. The JSON formatter pretty-prints an API response without uploading it, and the word and character counter keeps a bio inside its limit. All of the free tools work the same way: no account, no watermark, nothing stored on a server.