Generate a password
Choose a length and which characters are allowed, or switch to a passphrase of whole words. The draw happens in this tab, and the page reports what it bought in bits of entropy rather than a rating out of five.
How it works
How hard a password is to guess is not a property you can read off the characters. It is a property of the process that produced them, and the honest way to state it is in bits: the base-two logarithm of how many equally likely results that process could have given. Twenty characters drawn uniformly from 81 possibilities is 126.8 bits, and that figure does not change because the draw came out with three vowels together. Every number here is computed from the alphabet or word list in use, so none can drift from the code.
Bits, and why a strength meter is worse than none
A meter that grades the string it was handed is inspecting the wrong object. It can only reward patterns somebody taught it, and any pattern a meter rewards is one an attacker can apply too, which is how putting a zero where an o was raises a score without raising the work. The deeper trouble is that one string can be strong or worthless depending on where it came from: a meter cannot see whether it was drawn from 81 possibilities or chosen because it was the visitor's dog. Bits describe the draw.
Why the draw has to come from the cryptographic source
An attacker who can work out what the generator will produce next has no need to guess the password, so the bits are worth nothing unless the source is unpredictable. Every value here comes from crypto.getRandomValues, the browser's cryptographic generator, which exists to produce output that gives away nothing about the rest of the sequence. Math.random is built for simulations, where the requirement is that numbers spread out evenly rather than that nobody can anticipate them, and drawing a secret from it would make the entropy figure beside it a fiction.
Modulo bias, and the bytes this page throws away
Turning random bytes into characters is where uniformity is usually lost. A byte holds 256 values and the default alphabet holds 81, and 81 does not divide 256. Take the remainder and the first 13 characters of the alphabet get four source bytes each while the other 68 get three, making those 13 about 33% likelier than the rest. Nothing in the output would show it and every strength figure printed beside it would be an overstatement. So this page discards instead: a byte of 243 or more is thrown away and another drawn, 243 being exactly 3 times 81.
The number of bytes discarded is reported with every password, because a rejection sampler that never rejects cannot be told apart from one that folds the remainder in, and the count is the only evidence the loop exists. It is not always above zero, and that is a property of the alphabet rather than a fault: a size that divides a power of two needs no rejection at all. The word list here is 1,024 words for exactly that reason, and its row says so rather than reporting a zero that reads like a bug.
Passphrases and the size of the list
Diceware picks whole words at random instead of characters. The published EFF long list holds 7,776 words because that is 6 to the fifth power, one word per five dice, which makes each word 12.92 bits. Five dice are the wrong instrument for a browser, and shipping 7,776 words would be a large source file for one page. This list is 1,024 of those same EFF words, the four- and five-letter ones: 1,024 is 2 to the tenth, so every word is exactly 10 bits, and two random bytes divide into 1,024 sixty-four times over with nothing left to discard.
A shorter list is weaker per word, and the page reports that rather than rounding it away. Eight words here is 80 bits against 77.5 for six words of the full EFF list, so the default beats the classic six-word phrase at the cost of two more words to type. The list is also prefix-free: no word begins with another word. That means even with the separator set to nothing, two different sequences of words cannot spell the same string, so the entropy figure stays exact rather than quietly overstating by the number of collisions.
What excluding look-alike characters costs
Zero against capital O, and one against lowercase l against capital I, are the pairs that turn a written-down password into a phone call. Removing them is offered here and it is not free. The alphabet shrinks and every character carries less: with all four classes on, 81 characters become 76, so a 20-character password goes from 126.8 bits to 125.0. That is 1.8 bits given up, and one more character returns 6.2 of them. The page computes the loss for your own settings, because the option is worth taking and worth taking knowingly.
The rule that demands one of everything
Plenty of sites insist on at least one digit and one symbol. Enforcing that shrinks the space rather than growing it, by an amount this page counts exactly: the number of strings holding at least one character from every selected class, found by inclusion and exclusion over the classes and then turned into bits. At twenty characters the loss is 0.12 bits, because roughly one draw in thirteen misses a class and gets thrown away. At the six-character minimum it is 1.8, where seventy-one draws in a hundred miss. The sign is the part that matters, since the rule is nearly always presented as making a password stronger.
How the rule is enforced matters more than its cost. The quick way is to place one character from each class and shuffle, and that does not draw uniformly: it produces exactly one digit far more often than chance would, a pattern worth more to an attacker than the rule ever took away. This page draws whole candidates and discards any that miss a class, leaving every surviving password equally likely and matching the figure reported. A uniform draw from that restricted set is not a prefix of a longer one, so changing the length with the rule on has to draw again.
A password on a screen is a password in the room
The moment a secret is rendered it can be photographed, captured by whatever is recording the meeting, or read over a shoulder in an open-plan office. So displaying it is a choice here rather than an assumption: turn off Show it on screen and the value renders as dots while the copy button still puts the real characters on the clipboard. There is no download either, because a text file holding a password stays in a Downloads folder long after the moment has passed, and a clipboard is at least overwritten by the next thing you copy.
This is the one page in the suite where doing the work locally is the product rather than a nicety. A password a server generated is a password that server has held, and a page that posts one back over the network cannot show you otherwise. Everything above happens in this tab: the alphabet, the sampler, the word list and the arithmetic are all in the JavaScript already downloaded, and the secret exists in one browser tab until you paste it somewhere.
How long it would take to guess
A guessing time is a statement about the attacker rather than about the password, so the rate is a control here instead of a claim. Expect to search half the space, which puts the estimate at two to the power of the bits, halved, divided by the rate you chose. Every thousandfold rise in that rate removes about ten bits, and no rate ever changes which of two passwords is stronger. At a trillion guesses a second, 60 bits falls in about a week and 80 bits takes roughly nineteen thousand years, which is the gap the length control is really moving.
Questions
How many bits do I actually need?
Read it off the rate control rather than from a rule. At a trillion guesses a second, 40 bits falls in under a second, 60 bits in about a week, 80 bits in nineteen thousand years, and 128 bits outlasts any arithmetic worth writing down. Anything reused across sites, or guarding a password manager, belongs at the top of that range. A throwaway account on a site that locks out after five bad attempts is a different problem, and the 100-guesses-a-second setting is the one that describes it.
Is a passphrase weaker than a random string?
Per character, much weaker. Per password, that depends only on how many bits each carries, and the page reports both in the same unit so they can be compared directly. Eight words from this list is 80 bits and about 43 characters to type; the same 80 bits takes 13 characters of the mixed random alphabet. The passphrase is longer to type and far easier to carry in your head, which matters for the two or three passwords nobody can store in a manager.
Does the password change when I move the length slider?
No. The generated characters are cached and the length re-slices them, so a longer password extends the one you were reading and a shorter one trims it. Only the Draw a new one toggle re-rolls. The single exception is the require-every-class rule: a uniform draw from that restricted set is not a prefix of a longer draw, so with the rule on a change of length has to draw again. Going back to a length you already used returns the password you already had.
Should I use my password manager's generator instead?
For anything the manager will store, yes: it generates locally too, and it saves the password in the same action, which removes the step where a secret sits on a clipboard. This page is for the passwords that live outside one. The master password itself, a Wi-Fi key you have to read aloud, a router login, a machine you are setting up before the manager is installed. The passphrase mode exists for those, because they are the ones somebody has to remember or type by hand.
Can I copy it without ever seeing it?
Yes, and that is the point of the Show it on screen toggle. With it off the value renders as bullets, the entropy and alphabet rows keep working, and Copy answer puts the real characters on the clipboard. Nothing about the password reaches the screen, which is the right default for a shared desk, a recorded call, or a monitor someone can see from behind. The generated value is held only in the page, so the copy button reads it from the same place the display would have.
Does adding a digit and a symbol to a passphrase help?
Barely, and less than one more word. Appending one character from the 10 digits or the 19 symbols on this page, in a position an attacker will guess, adds at most 4.9 bits if you choose it at random. A word adds 10. If the character you append is a birth year or the site's initial then it adds nothing, because those are the first things a guessing program tries. The honest way to satisfy a site's rule is the require-every-class option in random mode, which prices itself.
Why 1,024 words rather than the full 7,776?
Because the alternative was shipping a 7,776-word list in a page whose whole job is a few hundred lines of arithmetic, and because a truncated list quoting the full list's entropy would be a lie. These are the four- and five-letter words of the EFF long list, and 1,024 of them is exactly 10 bits per word with no rejection needed. The cost is real and stated: each word carries 2.92 bits less than an EFF word, so a passphrase here needs one or two more words to match one built with dice.