Tool 1.9

Strong password generator & passphrase maker

Random passwords (8 to 128 characters) or passphrases, made in your browser with its cryptographic generator. Shows the entropy in bits. Nothing is sent.

Runs on your deviceRuns entirely in your browser: nothing you type or upload leaves your device.

How to use it

Choose Password or Passphrase.
Set the length (8 to 128 characters, or 3 to 20 words) and which characters to include. The passwords change as you go.
Pick one of the 5 results and save it in your password manager.

Password or passphrase: which one to pick

Pick Password for accounts saved in a password manager or your browser: you never type them, so 20 random characters cost you nothing. Pick Passphrase for the few secrets you have to remember or type by hand, such as your computer login or the master password of your password manager. Words are easier to type on a phone or with a TV remote than k#9Q….

Some sites cap the length or reject certain symbols. If one does, lower the length or untick Symbols, and watch the entropy number: add a few characters to make up for what you removed.

What 129 bits of entropy means

With the default settings, 20 characters using all four types, the tool shows 129 bits of entropy · very strong. Lower the length to 8 and it drops to 50 bits of entropy · fair; 12 characters give 77 bits, strong. The labels are: under 50 weak, 50 to 63 fair, 64 to 79 strong, 80 or more very strong.

A passphrase gets about 9 bits per word, because the words come from a list of 506. Eight words give 71 bits, strong; ten give 89, very strong. The Add a digit option adds about 3 bits. Exclude look-alikes drops I, l, 1, O, 0, o and |, which costs a little entropy but helps when the password will be read aloud or typed from paper, like a guest Wi-Fi password.

Habits that undo a strong password

Editing the result, for example adding your birthday at the end: the entropy shown only applies to the password exactly as generated. Using one generated password on several sites, so one leak exposes all of them. Saving it in a chat with yourself or in a note on your phone. Choosing the one you like best out of the 5 is fine: it costs at most about 2 bits.

The page doesn't keep the passwords, so if you close it before storing one, it's gone. Copy it straight into your password manager, or into the site's “new password” field and then into the manager.

FAQ

Is this password generator safe?

The passwords are created on your device with the browser's cryptographic random generator (`crypto.getRandomValues`), and they are never sent or stored; once the page has loaded it works offline too. What the page can't protect is what happens next, such as a password saved in a chat or reused on several sites.

How long should my password be?

For accounts that matter, aim for 80 bits of entropy or more: about 14 random characters with letters, digits and symbols, or a long passphrase. Use a different password for every site and keep them in a password manager.

What does entropy in bits mean?

It measures how many guesses an attacker would need: every extra bit doubles the work. The number shown is exact for the way this tool generates passwords, so it only applies if you use the result as is.

Can I use Spanish words in a passphrase?

Yes. The built-in list is in English, but a passphrase is just as strong in Spanish as long as the words are picked at random from a large list, for example with dice. What matters is the randomness, not the language. A sentence you make up, a saying or a line from a song is much easier to guess.

Should I change my passwords every few months?

Not on a calendar. Change a password when there's a reason: it appeared in a breach, you typed it on a fake page, or you shared it. Current guidance, such as NIST's in the United States, advises against forced periodic changes, because people end up with predictable patterns like `Clave1`, `Clave2`.

Guides for this tool

G2Has my password been leaked? How to check and what to doCheck if your password appears in a data breach without sending it, what to do if it does, and how to make strong passwords you can remember.
G13How to create a strong password you can actually rememberWhy long passphrases beat short complex passwords, how a password manager helps, 2-step verification, and what to do with the passwords you have.

1.1Is it a scam?Paste a message or link you received and see its warning signs: brand look-alikes, new domains, short links, scam wording.
1.2Scammed or hacked? What nowSteps for the first hours after a scam or a hack: a bad link, a shared code, a stolen WhatsApp, money sent.
1.3Is this file safe?See what a file from WhatsApp or email really is and spot attachment tricks: disguised programs, macros, PDF scripts, SMS-reading apps.
1.4Short link expanderSee where a short link (bit.ly, t.co, tinyurl…) really goes before you click it: every redirect, the final URL and warning signs.
1.5Website security scanPassive check of a website's homepage: HTTPS redirect, TLS certificate, HSTS, CSP, clickjacking, cookie flags and security.txt, with a grade and fixes.
1.6SSL certificate checkerCheck any site's SSL/TLS certificate: whether it's valid, when it expires, who issued it, which names it covers and the TLS version in use.
1.7Lookalike domain detectorCheck a link or domain for look-alike tricks: letters from other alphabets, digits for letters, a hidden real domain.
1.8Domain age checkerSee when a domain was registered, when it expires, its registrar and nameservers.
1.10Certificate decoderPaste a PEM certificate to read its subject, issuer, validity dates, SANs, key type and size, and its SHA-256 and SHA-1 fingerprints.
1.11Leaked password checkCheck if a password appears in known data breaches without sending it: with k-anonymity only 5 characters of its hash leave your device.
1.12Link cleanerStrip utm_, fbclid, gclid, si and other tracking parameters from links before you share them.
1.13Watermark an ID copyStamp who a copy of your ID is for, and the date, across the whole photo or PDF, then download a smaller copy with no photo data.
1.14Encrypt textEncrypt and decrypt messages or notes with a password (AES-256-GCM) in your browser.

╌╌ END ╌╌