Skip to main content
Generators

Password and Passphrase Generator

Generate 6-64-character pooled passwords or 3-8-word passphrases locally with browser randomness, optional similar-character exclusion, custom characters, separators, and opt-in session history. Essential for anyone creating strong, unique passwords for accounts, APIs, and secure access.

Password tools

In brief

Browser Crypto is preferred, but the current picker uses modulo reduction and has a Math.random fallback; displayed entropy is an estimate and selected character classes are not guaranteed individually.

What this tool supports

  • Password mode selects 6–64 characters from pooled uppercase, lowercase, digits, symbols, and optional custom characters, with an option that removes configured look-alike characters.
  • Passphrase mode selects 3–8 entries from the bundled 2,048-word list, optionally capitalizes each word, and joins them with one of eight separators.
  • Uses crypto.getRandomValues when present but reduces a Uint32 value with modulo; if Crypto is absent it falls back to Math.random.
  • Shows a pool-size/length entropy estimate and simple strength bands, copies results, and keeps up to ten values in component memory only when the global history setting is enabled.

How to use Password and Passphrase Generator

Follow this implementation-specific workflow for Local Random Password and Passphrase Generator; each step reflects the controls and limits in the current browser workspace.

  1. 1

    Step 1

    Provide the exact source

    Choose Password for a character string or Passphrase for a sequence of bundled English words.

  2. 2

    Step 2

    Choose the operation

    For passwords, set 6–64 characters and the pools; for passphrases, set 3–8 words, separator, and capitalization.

  3. 3

    Step 3

    Configure the available options

    Optionally exclude the configured look-alikes or add custom characters, noting that no selected pool is guaranteed to appear in a result.

  4. 4

    Step 4

    Run the local operation

    Generate, then inspect length, allowed characters, estimated entropy, and any receiving-site requirements before copying.

  5. 5

    Step 5

    Verify and continue

    Store the unique value in a trusted password manager and generate a different secret for every account.

Common mistakes

Assuming every checked character class must appear

Consequence: The generator samples one combined pool for every position and does not force at least one uppercase, lowercase, number, or symbol.

Fix: Regenerate until a legacy composition policy is met or use a generator that enforces required classes without weakening distribution.

Treating the entropy badge as a measured attack guarantee

Consequence: It assumes ideal uniform independent choices, ignores modulo bias and several custom/exclusion details, and cannot account for storage, phishing, reuse, or verifier policy.

Fix: Use the estimate as guidance only; prioritize length, uniqueness, secure storage, MFA/passkeys, and the service threat model.

Turning off all standard pools and relying only on custom characters

Consequence: The validation checks standard pool flags, so custom-only input returns “Select at least one option!” even when custom text exists.

Fix: Keep at least one standard pool enabled or use another audited custom-alphabet generator.

Best practices

  • Generate a unique password per account and place it directly into a trusted password manager.
  • Prefer a long generated value accepted by the service over memorizing a shorter composition-pattern password.
  • Clear visible output and clipboard history after use on a shared device, and enable MFA or a phishing-resistant passkey where available.

Connected workflows

Create and safely adopt a unique account password

Password and Passphrase GeneratorPassword Strength Checker

Generate a long value, check its receiving-site constraints, assess it independently, store it in a password manager, and enable a second factor.

  1. Choose a long supported configuration
  2. Generate a unique value
  3. Check service acceptance
  4. Store in a password manager
  5. Enable MFA or a passkey

Browser limitations

  • Modulo reduction introduces small selection bias, and environments without crypto.getRandomValues fall back to Math.random; this is not an approved high-assurance key generator.
  • The generator does not guarantee every selected class, check compromised-password lists, model site rules, normalize custom Unicode, or remove duplicate custom-pool characters.
  • The strength/entropy display is heuristic; passphrase words are English and session history may expose recent values on screen while enabled.

Authoritative resources

NIST SP 800-63B: Authentication and Authenticator ManagementPublisher: NIST · Reviewed: 2026-07-26Web Cryptography: Crypto.getRandomValues()Publisher: MDN Web Docs · Reviewed: 2026-07-26

Concrete examples

Input
Password mode; length 16; uppercase, lowercase, numbers, symbols enabled; exclude-similar off
Result
Exactly 16 characters, each sampled from the combined 90-character configured pool; no per-class presence guarantee applies.

The output cannot be deterministic because random indices are generated per position. A valid test asserts length and membership, not a fixed password.

Frequently asked questions

Does checking Symbols guarantee at least one symbol?

No. It adds symbols to the combined pool; independent random picks can still produce a password without one.

Is the displayed bit count exact?

No. It is an idealized length × log2(pool size) estimate and does not fully reflect similar-character removal, custom characters, modulo bias, or real attack conditions.

What list supplies passphrase words?

The current bundle contains 2,048 English words in code; it is selected locally and should not be described as the EFF long-word list without replacing and verifying it.

Are generated passwords saved after I close the page?

The workspace keeps up to ten recent results only in React state when history is enabled; it does not write this password history to localStorage.

Can I use this to generate cryptographic API keys?

Not for high-assurance key material. It outputs text with a modulo-biased picker and a non-cryptographic fallback; use the platform’s audited key-generation mechanism.

Privacy and offline behavior

Generation occurs in this browser and no password is uploaded. History is added only when the global history setting is enabled and remains in component memory for the open session; copying can still place secrets in operating-system clipboard history.