Password & Secret Generator

About this tool

How the secrets are made

Every character, word and byte comes from crypto.getRandomValues, the browser's cryptographic random number generator. Math.random is not used anywhere, because it was not designed for secrets and its output can be predicted.

Picking from a pool needs care. The common shortcut of taking a random byte modulo the pool size makes some characters slightly more likely than others whenever the pool size does not divide 256 evenly. This tool uses rejection sampling instead: it keeps only as many random bits as the pool needs, and a value that falls outside the pool is thrown away and drawn again. The rule of at least one character of each kind is applied the same way. A whole password that misses a kind is discarded, so every password that satisfies the rule is equally likely.

The secrets exist only on this page. They are not sent anywhere and not saved in the browser, and they are gone when you generate again or close the tab.

What the entropy number means

Entropy in bits is the base-2 logarithm of the number of equally likely results, so each extra bit doubles the work of guessing. The figure is computed from the options actually in use and rounded down to a whole bit. With all four kinds of character the pool has 87 characters, and a length of 20 gives 128 bits. Avoiding look-alikes shrinks the pool to 82 and the same length gives 126. The passphrase list has 1,024 words, which is exactly 10 bits per word: five words are 50 bits, eight are 80. A token is 8 bits per byte, so 32 bytes are 256 bits.

The number describes the generator, not the look of the result. It holds because the choice was random. A password that a person made up usually has far less entropy than its length suggests. A strong password that is reused on two sites is exposed on both as soon as one of them leaks it.

Which kind to choose

Use random characters for anything a password manager will store and type for you. Use a passphrase for the few secrets you must remember or type by hand, such as the password of the manager itself or of an encrypted disk, and add words rather than tricks to make it stronger. Use a token for secrets that only software reads: API keys, session secrets, signing keys for HMAC or JWT. Hex uses only digits and the letters a to f. Base64url carries the same bytes in fewer characters, and none of its characters needs escaping in a URL.

The look-alike option helps when a password is read aloud or copied from paper. The symbol set leaves out quotes, the backslash, the backtick, angle brackets and the space, which tend to break shell commands and configuration files. Symbols such as $, & and ! remain, so put the password in single quotes when you pass it on a command line.