Password generator

Yes. They are made with your browser’s cryptographic random generator (crypto.getRandomValues), the same source used for encryption keys. The passwords exist only on this page: they are not saved, logged or sent anywhere.

Both are strong when they are long enough. A 16-character random password has about 100 bits of entropy. A passphrase of 5 random words from a 5,000-word list has about 60 bits, and 6–7 words is very strong, while being much easier to remember and to type on a phone. The words are picked by the computer, not by you; that is what makes them safe.

It measures how many guesses an attacker would need; every extra bit doubles the work. Under 36 bits is weak, around 60 bits is fine for most accounts, and 80 bits or more is very strong. The crack time assumes a fast offline attack of 10 billion guesses per second.

It uses zxcvbn, an open-source estimator that looks for dictionary words, names, dates, keyboard patterns like “qwerty” and common substitutions like “@” for “a”. The password you type stays in your browser and is never stored.

Better not. Use a different password for every site, keep them in a password manager, and turn on two-step verification for important accounts. For random words for games instead, try Random Word Generator.