Secure Password Generator

What this tool does

It generates strong random passwords instantly, in two formats: characters (length and character sets of your choice: uppercase, lowercase, numbers and symbols) or a passphrase, several random words in English or Spanish that are easy to remember and to type. A live strength meter tells you how much entropy the key has while you adjust the options, and you can generate several at once.

The part that matters for security: the password is created in your browser with Web Crypto, the system’s cryptographic API. It is not generated on a server, not sent anywhere and no history is kept. It is the difference between a website that shows you a key and a website that knows your key.

How to use it

1. Adjust the length with the slider.
2. Tick the character sets: uppercase, lowercase, numbers, symbols.
3. If you will type it by hand, enable exclude ambiguous characters.
4. Copy the password, or generate a batch if you need several.

If you prefer a passphrase, switch to that mode at the top: pick how many words (3 to 10), the list language, the separator and whether you want a capital first letter or a number at the end. Batch generation works in that mode too.

What makes a password strong

A password’s resistance to a brute-force attack depends on two things: how many characters it has and how many different symbols each one is drawn from. The combination of both is summarised as entropy.

Length rules

Adding a character multiplies the number of possible combinations; adding a symbol type only enlarges the base. That is why a long password almost always beats a complex but short one:

• Xr7$q: 5 characters, looks “hard”, cracks in seconds.
• horse-battery-staple-correct: long and memorable, resists for centuries.

The practical rule: 16 characters minimum for ordinary accounts, 20 or more for your main email, banking and the password manager.

Entropy, in bits

Each bit of entropy doubles the attacker’s work. As a reference:

The meter computes real entropy from your length and character sets, not from cosmetic rules like “does it have an uppercase letter?”.

Passphrase: easy to remember and still strong

Some passwords you have to remember: the manager’s master password, the disk encryption key, the account you use to recover all the others. For those, x7$Kq!2mR#vL is a problem, not a solution. The alternative is a diceware-style passphrase: the generator picks four, five or six words at random from a list and joins them, for instance turtle-breeze-pantry-level-cedar. It sticks in memory as an absurd image and types without hunting for symbols.

What makes it strong is not the words, it is who picks them. A phrase a person makes up comes from a small, predictable vocabulary (“my dog’s name is…”); one picked by the generator with Web Crypto is uniform over the whole list, and each word adds log2(list size) bits:

The English list is the Electronic Frontier Foundation’s long list, the reference for the method; the Spanish one is our own, made of common words without accents or ñ so they can be typed on any keyboard and into any form. Because it is shorter, each word adds less: compensate with one more word.

Three details worth knowing:

• A capital first letter adds no bits. It is predictable. It is offered because some forms demand it, not because it protects.
• Appending a number adds about 6.6 bits (one in 100). It satisfies the form that asks for “at least one number” without sacrificing the phrase.
• With no separator the phrase keeps the same bits, but it is harder to read and easier to mistype. That is why the dash is the default.

For ordinary web accounts, which also limit attempts, four words are enough; for anything that can be attacked without limit (an encrypted disk, an SSH key, the master password), six or seven.

Myths worth throwing away

“Swapping letters for symbols makes it secure.” Turning password into p@ssw0rd fools nobody: attack dictionaries already include those substitutions. What gives security is randomness, not tricks.

“Changing the password every month is safer.” Modern guidance (NIST included) advises against forced rotation: it pushes people towards predictable variations such as March2026!, April2026!. Change a password only if you suspect it leaked.

“A good password is all I need.” No: use it once per site and add two-step verification wherever you can. The password is the first layer, not the only one.

The golden rule: one password per site

The most common attack today is not guessing your password: it is reusing one that already leaked. When a service suffers a breach and its database ends up online, attackers try that same email and password pair on dozens of other sites. It is called credential stuffing and it works precisely because almost everyone repeats keys.

A different, random password for every service cuts that attack at the root: a leak stays in one place. Since nobody can memorise dozens of random keys, the missing piece is a password manager: it generates, stores and fills a unique one per site, and you only remember the master key. That master key is the one job for a passphrase.