Overview
Three generators in one card — random passwords, memorable passphrases, and numeric PINs — and every one of them is drawn from crypto.getRandomValues(), the browser's cryptographically secure random source, rather than Math.random().
How It Works
Pick a mode tab and set the slider: 8–64 characters for passwords, 4–12 digits for PINs, or 3–8 words for passphrases. In password mode you can toggle the uppercase, lowercase, digit, and symbol pools and exclude look-alike characters. The output regenerates the moment any option changes; Copy puts it on the clipboard and Regen deals a fresh one.
Step-by-Step Usage Guide
- Choose the mode tab: Random password, Passphrase, or PIN.
- Drag the length slider — 16 or more characters for high-value accounts.
- Toggle character sets, and use Exclude look-alikes if the credential will be read from paper or typed by hand.
- Copy the result immediately; nothing is stored anywhere once you leave the page.
Technical Specifications & Standards
Randomness comes from window.crypto.getRandomValues(), which is seeded by the operating system's entropy pool, so the output cannot be reconstructed from earlier results the way a Math.random() sequence can. The Entropy Safety Gauge computes log2(pool size) × length for the active configuration — roughly 100 bits for a 16-character password using all four sets, about 8.5 bits per passphrase word from a 373-word list, and 3.3 bits per PIN digit — then buckets the score from Very Weak below 40 bits up to Bulletproof Security above 100.
Targeted Use Cases
- Master passwords for password managers, where a single credential protects everything else.
- API secrets, signing keys, and database passwords for staging environments.
- Device and SIM PINs that must stay short but not guessable.
- Passphrases for logins a human actually types, such as a disk-encryption password.
Notes & Gotchas
- The gauge measures the configuration, not the specific string: it assumes every character came from the full pool. crypto.getRandomValues() makes that true in practice, but remember you are rating the recipe, not the dish.
- Exclude look-alikes removes far more than 0O1lI — brackets, slashes, and most punctuation go too, which shrinks the symbol pool. Leave it off unless transcription is genuinely a problem.
- Passphrases draw from a curated 373-word list, not the 7,776-word EFF list, so each word is worth about 8.5 bits. Eight words is the maximum and lands near 68 bits, so use passphrase mode for credentials you have to type from memory and password mode for anything high-value.
- There is no history and no bulk mode: one credential per screen. Copy before changing options, because the previous value is gone.
Frequently Asked Questions
Are generated passwords sent anywhere or saved?
No. Generation happens in your browser from operating-system entropy, there is no server involved, and nothing is written to storage. When the page closes, the password is gone.
Why is Math.random() not good enough?
It is a deterministic pseudo-random generator: observing a short run of its output is enough to predict what comes next. crypto.getRandomValues() is designed to resist exactly that.
How long should my password be?
The gauge crosses into Highly Secure around 80 bits. With all four character sets enabled that is roughly a 13-character password. Passphrase mode cannot get there: eight words from a 373-word list is about 68 bits, which the gauge rates Medium Strength, so switch to password mode when you need more.
What does the two-digit number at the end of a passphrase do?
It adds roughly 6.6 bits of entropy and breaks the pattern of plain word joins, at the cost of one more thing to type.