Passphrase and password generator
Diceware-style passphrases and hard random strings from the browser's real CSPRNG, with the entropy shown.
Nothing leaves your browser. This tool does its work on your own machine — there is no upload, no server request, and nothing is stored.
Why the words, and why so many
The wordlist here holds exactly 1,024 words. That number is deliberate: 1,024 is two to the tenth, so every word drawn from it contributes exactly ten bits of entropy and the strength figure shown is arithmetic rather than an estimate. Six words is sixty bits; eight words is eighty.
Crucially, the strength comes from the selection process, not from the words being obscure. An attacker is assumed to have this list — it is right there in the page source. What they cannot do is predict which six of the 1,024 came up, and there are about 1.2 × 1018 ways for that to go.
What makes the randomness real
Two things matter. The first is the source: crypto.getRandomValues draws
from the operating system's cryptographic pool, not from the clock, the mouse, or
Math.random, which is fast, predictable, and completely unsuitable.
The second is subtler. Reducing a random number to a range with the modulo operator makes the low values slightly more likely — 256 does not divide evenly by 1,024's neighbours, and the bias favours whichever words sit at the start of the list. This generator uses rejection sampling instead: values that would land in the biased tail are thrown away and redrawn. The cost is a few extra bytes of randomness, and the result is a genuinely uniform choice.
Passphrase or random password?
Use a passphrase for the handful you actually have to type: the password manager's master password, your device login, your email. They are long, strong, and possible to remember and to read aloud.
Use a random password for everything a manager fills in for you. Nobody needs to memorise those, so there is no reason not to make them twenty-plus characters of noise.
What to do with it now
- Put it straight into a password manager rather than a note, a spreadsheet or a message to yourself.
- Use it in exactly one place. Uniqueness is what stops one site's breach becoming every site's breach.
- Turn on two-factor authentication on the account while you are there.
- Writing a master passphrase on paper and keeping it somewhere safe at home is perfectly reasonable. Burglars are not your password threat model.
Common questions
Are these passwords actually random?
They come from crypto.getRandomValues, the browser's cryptographic random number generator, sampled with rejection so there is no modulo bias. They are not generated from the time, your mouse, or a seed anyone can reproduce.
Why are word-based passphrases recommended?
Because you can remember them and they are still enormous. Six random words from a 7,776-word list is about 77 bits of entropy, far past anything brute force reaches, while staying typeable on a phone and on a TV remote.
Does the generated password get sent anywhere?
No. It is produced in your browser and never transmitted, logged or stored. Reload the page and it is gone for good.