About Strong Password & Passphrase Generator – Diceware
A strong password generator that runs entirely in your browser. Create random passwords with full control over length and character classes — lowercase, uppercase, digits, and symbols — or switch to a memorable passphrase built from a diceware-style wordlist. A live strength meter shows the estimated entropy in bits so you can see, at a glance, how hard a secret is to crack.
Every value is produced with your browser's cryptographically-strong randomness (the Web Crypto API), using rejection sampling for an unbiased result. Nothing is generated on a server and nothing is ever transmitted — the password and passphrase generator works fully offline, which makes it safe for dev secrets, API keys, and real account credentials alike.
Random passwords pack the most entropy per character, while passphrases trade a little length for something you can actually remember and type. Use the strength label to pick a length or word count that comfortably clears your threat model.
Features
- Random passwords with configurable length (4–256) and character classes
- Exclude look-alike characters (l/1/I/O/0) for error-free typing
- Memorable diceware-style passphrases with custom separator and capitalization
- Live strength meter showing estimated entropy in bits
- Crypto-strong, unbiased randomness via the Web Crypto API — fully offline
How to use
- Choose Password or Passphrase mode.
- For passwords, set the length and toggle the character classes you want; for passphrases, set the word count, separator, and capitalization.
- Check the strength meter, then copy the result — or press Regenerate for a fresh one.
Frequently asked questions
Are these passwords generated securely?
Yes. Randomness comes from crypto.getRandomValues in your browser, with rejection sampling to avoid modulo bias. Generation is entirely local — no password or passphrase is ever sent anywhere.
Password or passphrase — which is stronger?
Per character, a random password packs the most entropy. But a passphrase of 5–6 words from a large wordlist is both very strong and far easier to remember and type. Use the strength meter to compare: aim for 80 bits or more for important accounts.
What does the entropy value mean?
Entropy (in bits) measures how many guesses an attacker needs on average. Each extra bit doubles the search space. Below 40 bits is weak, 60–80 is solid for most accounts, and 80+ bits is very strong.
Why exclude look-alike characters?
Characters like the lowercase l, the digit 1, the capital I, and O versus 0 are easy to confuse when reading a password aloud or copying it by hand. Excluding them trades a tiny amount of entropy for fewer typos.
Is the passphrase wordlist the full EFF list?
This tool bundles a compact EFF-style wordlist of common, easy-to-type words so it stays fully offline with no dependencies. It is large enough for strong passphrases; for maximum entropy per word, increase the word count.
Related tools
Everything runs locally in your browser — your input is never uploaded.