Password & Token Generator
Passwords, passphrases and API tokens, generated from your browser’s cryptographic random source — crypto.getRandomValues, never Math.random — and existing only in this tab. The one place a password must never be generated is inside a logged AI chat, where the "random" string is predicted text and the conversation keeps a copy. Here the randomness is real and the copy is yours alone.
Password
Passphrase
API token
Strength checker
Random is a mechanism, not a vibe
Every secret on this page comes from crypto.getRandomValues, the browser’s interface to the operating system’s entropy pool — the same source your password manager uses. Selection is by rejection sampling, so every character and every word is equally likely; a naïve modulo of a random byte quietly favours some characters, and in a password generator a quiet bias is a real defect. Math.random appears nowhere: it is a fast, predictable generator built for animations, and its future output can be reconstructed from its past output. The entropy figures printed beside each result are computed from the actual pools — a 20-character password from all four sets is 20 × log₂(95) ≈ 131 bits; a five-word passphrase from the 560-word list is 5 × log₂(560) ≈ 45 bits — so you can compare shapes honestly instead of by how complicated they look. And the operational rule that motivates the whole page bears repeating: a password generated in a chat window is a password stored in that chat’s history, on someone else’s infrastructure, under an account that can be breached. The flagship article, never let a chatbot do your secrets, makes the full case; the hash identifier is the companion for the day you meet one of your old passwords in digest form.
Frequently asked questions
Why not just ask a chatbot for a password?
Three reasons, each sufficient. A chatbot’s "random" password is predicted text, not sampled randomness — models have measurable favourite patterns, and a password an attacker can predict the shape of is a password half-guessed. The chat is logged: the password you were just handed exists in a conversation history on a third-party’s servers, attached to your account. And the model cannot use a real random source — there is no crypto.getRandomValues behind a chat completion. This generator samples the browser’s cryptographic random source directly, and the result exists only in this tab. The full argument is in never let a chatbot do your secrets.
Password or passphrase — which should I use?
Both, for different hands. Machine-stored credentials (a password manager’s entries, API tokens) should be passwords or tokens: maximum entropy per character, never typed by a human. Anything a human must type or memorise — the password manager’s own master password above all — should be a passphrase: five words from a 560-word list carry about 45 bits and can actually be remembered, while the "clever" 10-character password it replaces usually carries less and is forgotten by Friday.
What does the entropy number actually mean?
The number of yes/no questions an attacker must answer, on average half of 2^bits guesses, to brute-force the secret — assuming they know exactly how it was generated, which honest estimates always assume. 40 bits falls to a motivated attacker with rented GPUs; 65 bits is out of practical reach for bulk attacks; 100+ bits is out of reach, full stop, for anything short of breaking the maths. The generator’s figure is exact for its own output, because the pool and length are known; the strength checker’s figure is labelled an estimate because a typed password’s true pool is a guess.
Is the strength checker’s verdict trustworthy?
As a floor, not as a promise. It models the pool your characters imply, then charges for the patterns cracking dictionaries exploit first — repeats, alphabet and keyboard sequences, years, and the internet’s most common passwords outright. What it cannot see is meaning: a pet’s name plus a birthday is "fair" by the maths and worthless against anyone who knows you. Treat a good verdict as necessary, not sufficient — and prefer a generated secret over a rated one whenever a machine can store it.
Are generated passwords stored or sent anywhere?
No. Generation happens in this page, from crypto.getRandomValues, and the results live in the tab’s memory until you close it. There is no account, no sync, no analytics event carrying your output. The corollary is on you: a generated password you do not immediately save into a password manager is gone when the tab closes — which is the correct failure mode, but plan for it.