Fresh sheet
Click a note to copy it. when you're done.
Strong passwords, minted in your browser. Nothing leaves this page.
Click a note to copy it. when you're done.
Every note carries its denomination: bits of entropy, the only honest measure of password strength. Times below assume an offline attacker testing 10¹² guesses per second against a fast hash — a slow hash like bcrypt or Argon2 stretches them millions of times longer.
A 40-bit password falls in . Throwaway accounts only.
64 bits holds for against a fast hash — decades against a slow one.
80 bits takes . Beyond any realistic attack budget.
128 bits takes . Cryptographic-key territory.
Every password is generated by your browser with crypto.getRandomValues() — the same cryptographically secure randomness it uses for TLS. Characters are drawn with rejection sampling, so there is no modulo bias. This page makes no network requests, its Content-Security-Policy forbids them, and it works offline — save the file and carry it with you.
No server ever sees a password: there isn't one. Passwords are never stored, logged, or sent anywhere. Your settings persist in a browser cookie, written only after you change a setting — like any cookie it travels only with requests to the site hosting this page, and it never contains a password. The entire generator is this single file. View the source to audit it.