Password generator

Choose random characters or words, and the page makes several passwords at once, each with a Copy button. For characters, pick a length, with one tap for 8, 12, 15, 16, 20 or 32 characters or any length from 4 to 128, and which kinds to use: capital letters, small letters, numbers and the symbols !#$%&()*+,-./:;<=>?@[]^_{|}~. That makes it a random password generator for a 16 character password, a 12 character one, or a long strong password for a password manager. Ticking “Avoid look-alike characters” leaves out I l 1 | O 0 o, which are easy to misread when you type a password by hand.

For a passphrase, choose 3 to 12 words, what goes between them, and whether to add capital letters and a number, which many sites ask for. The words come from the EFF large word list by the Electronic Frontier Foundation (CC BY 4.0): 7,776 common words picked to be easy to spell and tell apart.

Every choice uses your browser's secure random number generator, never the ordinary random function. Its numbers are turned into a choice by rejection sampling: a number that would make some characters slightly more likely than others is thrown away and drawn again, so every character, word and position is equally likely. When every kind of character must appear, a password missing one is thrown away and made again, rather than forcing one of each into place, which would make some positions easier to guess.

The strength shown is the number of bits of entropy, worked out from the settings: under 40 bits is weak, 40 to 60 fair, 60 to 80 strong and 80 or more very strong. The time shown assumes an attacker who has stolen a site's password list and tries 100 billion guesses a second, which only fast computers against weakly protected lists reach; most attacks are far slower.

Passwords are made from 4 to 128 characters and passphrases from 3 to 12 words, up to 20 at a time. Some sites refuse certain symbols; if a site does, untick symbols and add a few characters instead. The quotes, backtick, backslash and space are never used, because they cause the most trouble.

The page doesn't keep passwords for you. Save the one you use in a password manager or your browser. A copied password stays on your clipboard until you copy something else, and a clipboard history tool may keep it longer.

The strength is about how the password was made. A password you edit or type in from memory may be weaker than the number shown, and no password protects an account on a site that stores it badly, so use a different one for each site.