Password generator

How the password is made

Each character is drawn with the cryptographic random generator built into your browser, the same source it uses to secure connections. Every character of the chosen sets is equally likely at every position, and when you ask for several sets the password is guaranteed to contain at least one character of each, so it satisfies a site that insists on “a digit and a symbol”.

The password exists only on this page. It is not sent to a server, not written to storage and not kept in the address: reload, and it is gone. Once the page has loaded, the generator works with the network switched off.

What the strength figure means

Strength is measured in bits of entropy: the number of times you would have to double a single guess to cover every password the settings can produce. Each extra bit doubles the work of guessing. Length adds bits faster than anything else: one more character is worth about six and a half bits, while adding symbols to a long password adds only a fraction of one per character.

Passwords or passphrases

A passphrase is a few words drawn at random: tipped-playlist-frightful-zoom-abacus-contusion. Each word is picked from the EFF’s long list of 7,776, so each one adds about 12.9 bits, and six words carry about 77.5: as strong as a random password of twelve characters, and far easier to type on a phone or say aloud. Use one where you must remember or type the secret yourself, such as the password manager’s own lock or a computer’s login.

The words must be drawn at random, which is the whole point: a sentence you chose yourself, however long, is far easier to guess. The digit and the capitals are there for sites that insist on them; the strength comes from the words.

The words come from the EFF’s long word list, by the Electronic Frontier Foundation, under the CC BY 3.0 US licence. It is fetched by your browser from this site only when you ask for a passphrase.

Using it well

Use a different password for every account, so that one leak opens one door. Nobody can remember that many: let a password manager hold them, protected by one long passphrase you do remember. Turn on two-step verification wherever it is offered. A strong password protects against guessing; it does not protect against a page that tricks you into typing it.

Sharing a Wi-Fi password with guests? The QR code generator turns it into a code a phone can scan to join.