Password Generator

Where these passwords come from

They are generated by crypto.getRandomValues, your browser's cryptographically secure random number generator. That is a meaningful distinction. The ordinary Math.random that most simple generators use is predictable enough that it should never be used for anything security related.

There is also a subtle detail in how the random number is turned into a character. Taking a random number modulo the alphabet size introduces a slight bias towards the earlier characters. This tool rejects and redraws values that would fall in the biased range, so every character is equally likely. It is a small thing that most generators skip.

Nothing here touches a network. The password is created on your device and stays there unless you copy it.

Entropy, and what the numbers mean

Password strength is measured in bits of entropy, which is the number of guesses an attacker would need on average, expressed as a power of two. Each extra bit doubles the work.

Entropy	Roughly
Under 40 bits	Weak. Falls to a determined offline attack.
40 to 60 bits	Reasonable for low value accounts.
60 to 80 bits	Strong. Sensible for most real accounts.
Above 80 bits	Very strong. Appropriate for email, banking and password manager master passwords.

Length matters more than complexity. A 20 character lower case password has more entropy than a 10 character one using every symbol on the keyboard. If you have to choose between adding characters and adding character types, add characters.

Passphrases

The passphrase option strings random words together. Something like saffron-lantern-cobalt-glacier-47 is far easier to type on a phone and to remember than a random string, while remaining strong because the words are chosen randomly rather than by you.

The randomness is the whole point. A phrase you invent yourself is weak no matter how long, because human word choice is predictable. Four randomly chosen words from a decent list beats a "clever" sentence every time.

This is the right choice for the handful of passwords you must actually memorise: your device login, your password manager master password, your primary email.

Advice that has changed

Guidance from bodies including the United States National Institute of Standards and Technology has shifted considerably, and a lot of what people were taught is now considered counterproductive.

• Do not rotate passwords on a schedule. Forced expiry pushes people towards predictable variations such as adding a number to the end. Change a password when there is reason to think it is exposed.
• Length beats forced complexity. Mandatory symbol rules produce Password1! far more often than they produce anything strong.
• Never reuse a password. This is the one that actually catches people. When any site is breached, attackers try those credentials everywhere else. Reuse turns one company's failure into your problem.
• Use a password manager. It is the only realistic way to have a different strong password everywhere. Then you memorise exactly one.
• Turn on two factor authentication wherever it is offered, especially email and banking. An app based code or a hardware key is considerably stronger than SMS.

Common questions