How to use it

Pick Password, Passphrase or Check one.

Password: drag the slider (its label reads 16 characters to start; 8 to 128) and tick the kinds under What goes in: lower-case letters, capital letters, digits, symbols. Every ticked kind appears at least once. Leave out the look-alikes drops i l 1 I L o O 0.
Passphrase: drag the slider (4 words to start; 3 to 12) and choose what goes Between the words: -, ., _, space or none.
Press Copy, or Regenerate for another. Any change to a setting draws a new one too. Below it, a bar and a line like 103 bits · very strong rate it, with the arithmetic underneath.

In Check one, type into The password to check (masked unless you tick Show it). You get a verdict with its reasons, four pass-or-fail pattern lines, and a table of Length, Kinds, Pool and Entropy.

Examples

The defaults: 16 characters, all four kinds. The page passes 1,024 fresh bytes from crypto.getRandomValues for each password; to make this repeatable, these 32 bytes were passed instead:

ee078df9ab5b65e87b9180fbb643c4efe248c7090d413d537a80290eaa0f2c2b

5O^-jnP$19,IO;hP
103 bits · very strong
16 characters × log2(88) = 103 bits

With Leave out the look-alikes ticked, the same bytes give X_45z+WQ?=|T>khq, from a pool of 80: 101 bits · very strong.

A passphrase of 6 words with space between them, from the same bytes (two per word):

porch poet float plane fuse brain
66 bits · strong
6 words × log2(2048) = 66 bits

Checking Asdf1234:

weak — a sequence like abcd or 1234, a keyboard pattern
12 bits
✓ Not one of the 200 most common passwords
✓ No character three times in a row
✕ A run like abcd or 1234
✕ A run along a keyboard row
Length   8 characters
Kinds    lower-case letters, capital letters, digits
Pool     62 characters
Entropy  12 bits · 8 characters, 2 independent × log2(62) = 12 bits

Asdf runs along a keyboard row and 1234 counts up, so each run counts as one character. Password1 scores one of the 200 most common passwords → 8 bits: matching ignores case, and password1 is on the list. qwerty fails two checks, the common list and the keyboard row, and the list sets its 8 bits.

With every kind unticked, the page says Pick at least one kind of character: lower-case letters, capitals, digits or symbols.

Good to know

The estimate is length × log2(pool). A character from the full pool of 88 adds about 6.5 bits, so length beats variety: 16 characters without symbols is 95 bits, 18 is 107. Below 40 bits is weak, then fair from 40, strong from 60 and very strong from 80.
There is no modulo bias. byte % 88 would favor the first 80 characters, since 256 is two rounds of 88 plus 80. So a byte of 176 or more is thrown away and the next one used, and every character is equally likely.
Symbols are a fixed set of 26: !@#$%^&*()-_=+[]{}|;:,.<>?.
Passphrase words come from 2,048 common words of three to seven letters, so each word is exactly 11 bits and the separator adds none. Words can repeat, because each draw is independent. The EFF’s 7,776-word Diceware list gives about 12.9 bits a word.
Check one sees characters, not words. It catches the 200 most common passwords (whole password, any case), a character three times in a row, three letters or digits counting up or down, and four keys along a letter row. Words, names, dates and swaps like @ for a go unnoticed: P@ssw0rd! rates fair at 58 bits, Summer2024! strong at 71, and the passphrase above rates 157. Read the number as an upper bound.
Accents, spaces and emoji count as other characters, each distinct one adding one to the pool.
Passwords are 8 to 128 characters, passphrases 3 to 12 words, the separator up to 8 characters; Check one reads up to 200.

Questions

How long should a strong password be?

For a random password with all four kinds, 13 characters reaches 80 bits and 16 gives 103, well past what guessing can cover. Randomness matters more than looks: a word plus a year is weak however it scores. NIST SP 800-63B tells sites to drop composition rules and forced periodic changes, and to reject passwords on lists of common or breached ones.

Is it safe to use an online password generator?

Yes, if the password is made in the page from a cryptographic random source and never sent, which is how this one works: generating and checking both happen in your browser. crypto.getRandomValues is the browser’s secure generator; Math.random isn’t, and shouldn’t make passwords.

How many words should a passphrase have?

Six words from this list gives 66 bits and eight gives 88; four, at 44 bits, rates only fair. The words must be drawn at random: a phrase you pick, like a lyric, is far easier to guess than its length suggests.

How do I generate a random password in the terminal?

openssl rand -base64 24 prints 32 characters from 24 random bytes, which is 192 bits. In Python, python3 -c "import secrets; print(secrets.token_urlsafe(16))" prints 22 URL-safe characters from 16 bytes.

Password Generator