Free Password Generator — Secure Random Passwords

Entropy assumes the characters were chosen unpredictably. If the generator itself is predictable, the entropy figure is fiction no matter how long the password is.

Ordinary JavaScript randomness — `Math.random()` — is not suitable. It is a fast pseudo-random generator designed for simulations and games. Its internal state is small, its seed is not secret, and researchers have demonstrated recovering that state from a short run of outputs and then predicting every subsequent value. A password generator built on it produces passwords that look random and are reconstructable by anyone who sees a few of them.

The correct source is the platform's cryptographic generator, exposed in browsers as `crypto.getRandomValues`. It draws from the operating system's entropy pool, which is seeded from hardware sources, and it is designed so that observing past output tells you nothing about future output. This page uses it.

There is a subtler flaw even with a good generator: taking a random number modulo the pool size biases the result. If the pool has 88 characters and the random source produces values from a range that is not a multiple of 88, the first few characters come up slightly more often. The fix is rejection sampling — discard values in the uneven tail and draw again — which is what happens here.

For the passwords you have to type from memory, random character strings are the wrong tool. Four or five random words are easier to remember and can carry comparable entropy.

The arithmetic: choosing uniformly from a 7,776-word list gives log₂(7776) = 12.9 bits per word. Four words is 51.7 bits, five is 64.6, six is 77.5. So a six-word passphrase is roughly equivalent to a 12-character random password, and far easier to type on a phone.

The conditions are strict. The words must be chosen randomly — by dice or by software, not by you — and the list size must be known. A phrase you composed yourself carries a fraction of the entropy, because human word choice follows grammar and association.

"correct horse battery staple", from the well-known comic, is now in every cracking dictionary. That does not invalidate the method; it illustrates that a published example is no longer random.

Diceware —

the original method: roll five dice per word to index a 7,776-word list. Physically random, verifiable, and independent of any software you have to trust.

Where passphrases fit —

the handful you must memorise — your password manager's master password, your device login, your email. Everything else should be a long random string you never see.

The strongest password is worth little if it is reused, and reuse is the single largest cause of account compromise. When one site is breached, attackers replay the credentials everywhere else — credential stuffing — and it works because most people reuse.

The workable arrangement is a password manager holding a unique 16-to-20-character random password for every account, protected by one long passphrase you memorise, with two-factor authentication on the accounts that matter.

Two-factor is worth more than any password improvement. A stolen password alone does not get an attacker in. App-based codes or a hardware key are meaningfully better than SMS, which is vulnerable to SIM swapping — though SMS two-factor still beats none.

Current NIST guidance also reversed two long-standing rules: it recommends against forced periodic password changes, which push people toward predictable increments, and against composition rules that mandate particular character types. Change a password when there is reason to think it is exposed, not on a schedule.