Secure Password Generator

Length beats complexity. A 20-character lowercase password has more entropy than a 10-character one using every symbol on the keyboard, and it is far easier to type on a phone. If you only change one habit, make your passwords longer rather than more decorated.

The substitutions people think are clever are the ones attackers try first. Replacing a with @ or o with 0 adds almost nothing, because every cracking wordlist has applied those rules to every dictionary word for the last twenty years. A password built from a real word plus a predictable mangling is a dictionary word.

This generator reports entropy in bits, which is the honest measure: how many guesses an attacker needs on average. Below 50 bits is weak against a determined attacker with modern hardware. Above 80 bits is strong enough that the password is no longer the weakest part of your account.

A random string is the right choice for anything a password manager will remember for you, which should be almost everything. There is no reason to keep it short or memorable when software does the remembering.

A passphrase earns its place for the handful of secrets you genuinely have to type from memory: your device login, your password manager's master password, a disk encryption key. Four random words carry roughly 52 bits of entropy, and you can actually recall them.

The PIN mode exists because some systems still insist on digits only. A 6-digit PIN is weak in isolation and is only acceptable where the device enforces a lockout after a few wrong attempts.

Every password is produced locally with the Web Crypto API, specifically crypto.getRandomValues, which is the same cryptographically secure source browsers use for TLS key material. Characters are drawn with rejection sampling so no part of the character set is favoured, and the final shuffle is a Fisher-Yates pass rather than a sort with a random comparator.

Nothing is transmitted. There is no request carrying your password to a server, no logging, and no analytics event containing the generated value. The history list lives in the page and disappears when you close the tab.