Password & Passphrase Generator
Random secrets created in this browser with the Web Crypto random source. Nothing is stored, logged or sent anywhere.
Never stored · generated locally
Options
Results
Estimated entropy–
Fast offline attack (1010 guesses/s)–
Very large rig (1012 guesses/s)–
Crack times are rough illustrations, not guarantees. They assume the attacker already has a fast, unsalted hash, knows exactly how this secret was generated, and averages half the search space. Real-world resistance depends on how the service stores passwords (slow salted hashes are far harder to attack, weak hashes easier), on breaches, phishing and malware, and on never reusing a secret. Online guessing is usually rate-limited and much slower.
How it works
- Randomness comes only from
crypto.getRandomValues;Math.randomis never used. - Each character or word is picked with rejection sampling, so there is no modulo bias.
- When several character sets are selected, a password is regenerated until it contains at least one of each. Entropy is computed from the exact number of qualifying strings.
- Passphrase entropy is words × log2(7,776) ≈ 12.9 bits per word. Capitalisation and separators are fixed and add nothing.
- Results exist only in this page's memory and are cleared when you leave it. Use a password manager to store them.
Word list: EFF Large Wordlist for Passphrases (7,776 words) by the Electronic Frontier Foundation, licensed CC BY 3.0 US, bundled locally.