Password & Passphrase Generator Nothing sent or saved.

A password drawn at random has no pattern to find. Its strength is simply the number of possibilities.

• Longer beats more complicated: each extra character multiplies the search.
• One password per account: a leak on one site then stays on that site.
• Keep them in a password manager, ideally one that is open source and independently audited.

The page calls crypto.getRandomValues and discards any draw that would make one character or word more likely than another.

• Nothing is sent. The generator makes one request after loading: it fetches the word list, from this site, the first time you choose Passphrase.
• Nothing is saved in your browser: no cookies, no storage.
• It keeps working offline once the page, and for passphrases the word list, has loaded.

Times on this page assume 100 billion guesses a second, an offline attack on a fast hash, and give the average: half of all possibilities. A larger attacker is faster; a site that stores passwords with a slow hash such as bcrypt or Argon2 makes each guess far costlier. All figures are rounded down.

• Under 60 bits: Weak, or Very Weak below 45.
• 60 to 79 bits: Moderate.
• 80 bits and more: Strong, or Very Strong from 100.