Password generator — offline

A password generated by a website is a password that website generated. Even assuming complete good faith, the value existed in a server process, possibly in a log, and travelled across a network — for a secret whose entire value depends on nobody else having seen it. The threat is not hypothetical: a generator that logged its output, or was compromised, would hand an attacker a candidate list dramatically smaller than brute force.

Every password here comes from your browser's cryptographically secure random generator and exists only on your screen until you copy it. There is nothing to log, because there is no backend — this site is static files, and a Content-Security-Policy blocks third-party requests. Disconnect from the network and it still works.

Most password strength meters are theatre — they reward you for adding an exclamation mark and a capital letter and call the result "strong". This one shows entropy in bits, computed from the character set size and the length you chose. That is the honest measure: it is precisely how much work an attacker who knows your generation method has to do.

Aim for at least 80 bits. With letters, digits, and symbols that means about 14 characters; more is always better, and for anything protecting other secrets — a password manager's master password, a disk encryption key — target 100 bits or more.

Length beats complexity. Adding one character multiplies the search space by the size of the alphabet, while swapping a for @ in a short password adds almost nothing and is exactly what cracking dictionaries already try first.

Exclude ambiguous removes the lookalikes — 0 and O, 1 and l and I, the pipe character — for passwords that have to survive being read aloud, dictated over a phone, or typed from a printed sheet. It slightly reduces the alphabet, so add a character or two to compensate; the meter shows the effect immediately.

A generated password only helps if the rest of your practice holds up. Use a unique one per site, because credential-stuffing attacks rely entirely on reuse. Store them in a password manager rather than a notes file — a random password you cannot remember is otherwise a password you will write down badly. And enable two-factor authentication where it is offered: it defends you even when a password does leak.

More on this in how to generate a strong password. Related and equally local: UUID generator for identifiers rather than secrets, and hash generator for checksums.