Question 1

Are the passwords I generate sent to or stored on any server?

Accepted Answer

No. Every password and passphrase is generated entirely in your browser using the Web Crypto API. Nothing you generate is uploaded, logged, saved, or transmitted — there is no account and no history. Close the tab and it is gone.

Question 2

What makes these passwords cryptographically secure?

Accepted Answer

The generator draws randomness from crypto.getRandomValues(), which is backed by your operating system's cryptographically secure random source — never Math.random(), which is predictable. Each character or word is chosen using rejection sampling, so there is no bias toward any character and every possibility is equally likely.

Question 3

How long should my password be?

Accepted Answer

For most accounts, 16 characters with a mix of uppercase, lowercase, numbers, and symbols is strong. For high-value accounts (email, banking, password manager), use 20 or more. The strength meter shows the real entropy in bits — aim for 'Strong' (60+ bits) or 'Very strong' (128+ bits).

Question 4

What is a passphrase and why might it be better?

Accepted Answer

A passphrase is several random words joined together (for example, brave-lemon-tiger-cloud-nine). It is far easier to remember than a random string of symbols while being just as hard to guess when you use enough words. This tool builds passphrases from a 256-word list, so each word adds 8 bits of entropy — a six-word passphrase has about 48 bits, and more words means more strength.

Question 5

What does 'bits of entropy' mean?

Accepted Answer

Entropy measures how unpredictable a password is — how many attempts an attacker would need on average to guess it. Each extra bit doubles the difficulty. It is computed honestly here from the password length and the size of the character pool (or the number of words and the word-list size), not estimated from patterns.

Question 6

How is the 'time to crack' estimated?

Accepted Answer

It assumes an offline attacker making 100 billion guesses per second against a weak password hash, and shows the average time to exhaust half the keyspace. It is a deliberately conservative worst case for awareness; a site that stores passwords with a slow, salted hash (bcrypt or Argon2) would take far longer.

Question 7

What are look-alike (ambiguous) characters?

Accepted Answer

Characters that are easy to confuse when read or typed, such as the lowercase L, the number 1, the capital I, the capital O, and the number 0. Turn on 'Exclude look-alike characters' when a password may be typed by hand or read aloud.

Password Generator

How this works & your privacy

Limitations

Standards & references

Frequently Asked Questions

Password Generator

How this works & your privacy

Limitations

Standards & references

Frequently Asked Questions