Password Generator

Where the randomness comes from

The only real job a password generator has is to make unpredictable choices. Most examples online reach for Math.random(), which is not a cryptographic generator: its internal state can be recovered from a handful of outputs. Anyone who has seen a few passwords it produced can predict the next one.

Every byte here comes from crypto.getRandomValues, the browser's cryptographic generator seeded by the operating system. The same rule governs the UUID generator elsewhere on this site.

The invisible defect: modulo bias

Taking randomness from the right source is not enough; it also has to be mapped onto the alphabet correctly. Nearly every example does this:

1// Biased whenever 256 is not a multiple of the alphabet size2alphabet[byte % alphabet.length]

This tool's full character set has 90 entries. 256 does not divide evenly by 90, so the first 76 characters are drawn 3 times in 256 and the remaining 14 only twice. Some characters therefore appear fifty percent more often than others. The search space really does shrink, and nothing about the output reveals it.

The fix is rejection sampling: draws that land above the largest exact multiple of the alphabet size are discarded and redrawn. The discarded values are precisely the ones that would have skewed the distribution, so the result is uniform by construction rather than approximately uniform.

Why there is no strength label

Most password tools show a coloured bar and the word "Strong". That is a judgement dressed as a measurement, and it is usually computed from character-class rules: is there an uppercase letter, a digit, a symbol.

Those rules reward the wrong thing. "P@ssw0rd!" contains all four classes, turns most meters green, and survives a dictionary attack for seconds. A six word passphrase contains no uppercase letter at all and cannot be brute forced.

This tool reports entropy in bits and shows the inputs to that calculation beside it: the alphabet size and the length. The number becomes something to verify rather than something to believe.

A rule that is deliberately absent

Almost every generator guarantees at least one character from each selected class. It sounds like it improves security. It reduces entropy.

The reason is that the rule removes from the probability space every password that happens not to contain a digit. A smaller space is an easier space to guess. It also leaks a little structure to an attacker who knows how the generator works. There is no such rule here: the classes you select define the alphabet, and the draw over that alphabet is uniform.

When a passphrase is the right choice

The two modes solve different problems. A random string is correct for anything a password manager will hold, since you will never type it again. A passphrase is correct for the handful of secrets you have to type or remember: a disk encryption key, a WiFi password read aloud across a room, the master password guarding everything else.

The difference is not small. A master password nobody can remember gets written on paper or simplified until it can be, and both outcomes weaken everything it protects.

Why the wordlist is English

The list was Turkish first, which seemed natural for this audience and was wrong for the job. A passphrase exists to be TYPED: into a disk encryption prompt before any keyboard layout has loaded, into a router admin page, or read aloud across a room.

Turkish characters break all three. A third of that first list carried ç, ğ, ı, ö, ş or ü, and a phrase containing them cannot be typed on a US keyboard, is mangled by systems that are not UTF-8 clean, and is ambiguous when dictated. English words are what every keyboard on earth can produce.

Every word is three to five letters, and every word has a unique three letter prefix. That second criterion comes from the EFF list: typing three letters identifies the word, which matters both for autocomplete and for reading a phrase out to someone.

Why exactly 1024 words

The wordlist holds exactly 1024 words, and that number is not an accident. 1024 is two to the tenth, so a word drawn uniformly from the list carries exactly 10 bits, and a phrase of n words carries exactly 10n.

A list of 1000 would give 9.97 bits per word. The arithmetic is fine and the communication is worse: the figure then reads like an estimate. At 1024 the reported number is a fact anyone can confirm by counting the list.

14 words = 40 bits25 words = 50 bits36 words = 60 bits47 words = 70 bits

Capitalising the words or appending a digit adds almost nothing to the entropy. Those options exist to satisfy policies that demand a capital or a number, and the reported figure ignores them. Counting them would be inflating it.

What this page does not do

The generated password is not stored anywhere. It is not written to the address bar, because a URL goes to analytics and lives on in browser history and server logs. There is no "recently generated" list, because such a list turns one compromised device into every password you ever made here. Nothing goes into local storage either.

The one deliberate exit path is the clipboard. Pressing Copy writes the password to the system clipboard, which your operating system may sync between your devices and which other applications can read. That is your decision rather than a hole, but a page that enumerates what does not happen owes you the one thing that does.

This page also carries no advertising. The generated secret is live in the document, and putting a third-party frame in the same page is not compatible with the promise this page makes. Other tool pages on this site do show ads; here it is switched off deliberately.