~/tools / password-generator
// security

Password & Passphrase Generator

Every character comes from crypto.getRandomValues, the browser's cryptographically secure generator, with rejection sampling so no character is more likely than another.

● generated locally — never transmitted or stored

Passwords

How strong is strong enough?

Strength is measured in bits of entropy: length × log2(alphabet size), valid only when every character is picked at random — which is exactly what this generator does. Rough guide for offline attacks against a fast hash:

  • < 60 bits — weak, crackable with commodity GPUs
  • 60–80 bits — fine for online accounts with rate limiting
  • 80–100 bits — strong; good for admin and VPN accounts
  • > 100 bits — overkill for humans, ideal for API keys and PSKs

Passwords vs passphrases

A passphrase built from random words is far easier to type and remember at similar strength. This generator uses a list of 1024 short words, so each word adds 10 bits: six words ≈ 60 bits, eight words ≈ 80 bits. Store everything in a password manager either way.