How this generator works
Every password and passphrase is generated locally in your browser using
window.crypto.getRandomValues, the same cryptographically secure
random source used by browser TLS. Nothing is sent to a server, no analytics
event records the value, and closing the tab erases it from memory.
The source code is a single static HTML file with no build step and no third-party JavaScript. You can save the page and run it offline.
What NIST 800-63B actually recommends
The current US federal guideline (NIST SP 800-63B) marked a sharp departure from older advice. The points most often misunderstood:
- Length beats complexity. A long passphrase is stronger than a short string padded with symbols. Allow up to 64 characters and any printable Unicode.
- No forced periodic rotation. Rotate only on evidence of compromise. Forced 90-day changes lead to weaker, predictable variants.
- No composition rules. Don’t require at least one digit, one symbol, etc. Check candidates against breach corpora instead.
- Screen against known breached passwords rather than dictionaries of common words.
Random string vs. memorable passphrase
A 16-character random string from a 70-character alphabet provides roughly 98 bits of entropy. A 5-word BIP39 passphrase (2048-word list) provides about 55 bits, and a 6-word passphrase about 66 bits — enough to resist any offline attack against a properly hashed credential. Pick the random mode for credentials you’ll store in a manager, and the passphrase mode for anything you have to type or dictate.
Frequently asked questions
Is this password generator safe to use?
Yes. Generation happens in your browser using the Web Crypto API. No password is ever transmitted, logged, or stored on any server.
What length should a strong password be?
NIST 800-63B allows up to 64 characters. In practice, aim for at least 16 random characters, or a 4–6 word passphrase.
Are passphrases more secure than random passwords?
Per character they’re less dense, but a 5- or 6-word passphrase from a large wordlist exceeds the entropy of a typical random password while being far easier to remember.
Does NIST still recommend periodic password rotation?
No. NIST 800-63B explicitly recommends against forced periodic rotation. Change a password only on evidence of compromise.
Which languages are supported for passphrases?
English, Spanish, French, Italian, Portuguese, and Czech, all using the official BIP39 wordlists.