Strong password generator - random passwords and passphrases

The strength of a random password is its entropy in bits: E = L × log₂(N), where L is the length and N the number of possible characters. Every extra bit doubles the number of guesses an attacker needs.

* at 10 billion guesses per second - a realistic rate for an offline attack on a leaked database hashed with a fast function (MD5, SHA-1) using a few graphics cards. Sites that use bcrypt or Argon2 slow such attacks down by thousands of times.

• Cryptographic randomness - characters are picked with crypto.getRandomValues(), the browser’s CSPRNG, not the predictable Math.random().
• No modulo bias - a naive random % N makes some characters slightly more likely. The generator uses rejection sampling, so every character has exactly the same chance.
• Every set at least once - the password contains at least one character from each selected set, and positions are shuffled with the Fisher-Yates algorithm.
• Optional look-alike exclusion - drop I, l, 1, |, O, 0 and o when a password must be read aloud or typed from paper.
• Fully local - nothing is sent, logged or stored. The tool keeps working offline.

A passphrase is a string of randomly chosen words, such as Comet-Pumpkin-Harbor-Winter4-Teapot-Otter-Satchel. It is longer but far easier to remember and to type on a phone. The English word list has 378 common, easy-to-spell words, which gives about 8.6 bits per word, so choose 7 or more words for strong protection. What matters is that the generator picks the words, not you: human-chosen phrases like “ILoveMyDog2026” are predictable and appear in cracking dictionaries.

Current NIST guidance (SP 800-63B) favours length over complexity rules: at least 15 characters when a password is the only factor, no forced periodic changes, and a check against known breached passwords. Use a unique password for every site - a password manager makes that practical - and turn on two-factor authentication wherever you can.

Need random identifiers instead of secrets? Use the UUID generator.