Kodigo Labs ToolsHow to use the password generator
Choose Password for a random string of characters, or Passphrase for a few random words that are easier to type and remember. Set the length or number of words and the options you need, then press Generate. Each result has its own Copy button. The panel shows the entropy in bits, a plain strength label and roughly how long it would take to crack.
If a site does not accept some symbols, type them into Never use these characters. Keep At least one of each selected type on for sites that insist on a capital letter, a number and a symbol.
Worked example
A 16-character password using upper and lower case letters, numbers and symbols picks each character from 94 possibilities, so it has 16 × log2(94) ≈ 104.9 bits of entropy. Requiring at least one character of each type rules out a few combinations and lowers that slightly, to about 104.6 bits. Even at 10 billion guesses a second, cracking it would take far longer than the age of the universe. By contrast, an 8-character password of only lowercase letters has 8 × log2(26) ≈ 37.6 bits and could be cracked offline in seconds.
A passphrase such as Mango-Pebble7-Harbor-Ladle-Tidings-Oyster (example only, do not use it) built from 6 random words of the 7,776-word list has 6 × 12.9 ≈ 77.5 bits, plus about 5.9 bits for the digit placed after a random word.
How the randomness works
Characters and words are chosen with crypto.getRandomValues, never Math.random. To pick one of n items fairly, the tool draws a random 32-bit number and keeps it only if it falls below the largest multiple of n that fits in 32 bits; otherwise it draws again. This "rejection sampling" makes every item exactly equally likely. Simply taking the random number modulo n would slightly favour the first items whenever 232 is not a multiple of n.
Word list: EFF Large Wordlist for Passphrases (7,776 words) by the Electronic Frontier Foundation, used under the Creative Commons Attribution 3.0 licence.
Frequently asked questions
Are the passwords sent anywhere or saved?
No. Every password is created in your browser with crypto.getRandomValues, the secure random number generator built into your browser for encryption. Nothing is sent to a server, logged or stored. Once you close or refresh the page, the passwords are gone, so save the one you use in a password manager.
How long should my password be?
For accounts that matter (email, GCash, online banking, work logins), use at least 16 random characters, or a passphrase of 6 or more words. That gives roughly 80 bits of entropy or more, which is far beyond what anyone can guess. Never reuse the same password on two sites; a password manager makes that easy.
What does entropy in bits mean?
Entropy measures how many equally likely passwords the generator could have produced with your settings. Each extra bit doubles the number of guesses an attacker needs. A 16-character password from all 94 keyboard characters has about 16 × log2(94) ≈ 105 bits. A 6-word passphrase from the 7,776-word list has 6 × log2(7776) ≈ 77.5 bits. The figure assumes the attacker knows your settings but not the random choices.
Is a passphrase as safe as a random password?
Yes, if it has enough words and the words are chosen at random, as this tool does. Six random words are about as strong as a 12-character random password and much easier to type and remember. A phrase you make up yourself, like a song lyric, is much weaker because people choose predictable words.
Why exclude look-alike characters?
Characters such as capital I, small l, the number 1, capital O and the number 0 look almost the same in many fonts. Leaving them out helps when you must read a password aloud or type it from paper, for example a Wi-Fi password. It removes only a few characters, so the password stays strong; the entropy shown already accounts for it.