usefulweb.site Password & Passphrase Generator

Cryptography & security tools

Password & Passphrase Generator

Strong random passwords and passphrases, made in your browser, with exact entropy.

characters

Random password only. 16+ characters are recommended; 20+ for important accounts.

Character sets

Passphrase only. Each word adds 11 bits of entropy.

Leave empty for real use. With a seed, anyone who knows it can regenerate the same passwords.

Try an example: 5 passwords, 20 characters, all sets (demo seed) · 6-word passphrase, Title Case, with a digit (demo seed) · 12 characters, letters and digits, no look-alikes (demo seed)

How it works

Generates random passwords (length, character sets, no look-alike characters, at least one of each class) or passphrases from a 2048-word list with separators and capitalisation. Shows the exact entropy in bits and how long guessing would take. With JavaScript on, everything is generated locally in your browser.

  • Random password: every character is drawn uniformly from the selected sets with an unbiased random integer (rejection sampling, no modulo bias). "At least one of each set" regenerates the whole password until the rule holds, which keeps all valid passwords equally likely.
  • Entropy is exact: log2 of the number of possible passwords. With "at least one of each set" the count is computed by inclusion–exclusion, so it is slightly lower than length × log2(pool size).
  • Passphrase: words are drawn uniformly from a bundled list of 2048 common English words (4–8 letters), so each word adds exactly 11 bits. Random capitalisation adds 1 bit per word; an appended digit adds log2(10 × words) bits.
  • Guessing times assume the attacker knows exactly how the password was generated (the worst case) and finds it on average after trying half of all possibilities.
  • In the browser, passwords are generated locally with crypto.getRandomValues and never sent anywhere. Without JavaScript (and via the API/MCP), the server generates them with Node.js crypto.randomInt and sends them back over HTTPS without storing them.

Use a password manager and a different password for every account. Seeded output is for demos only.

Sources

For scripts and AI agents

  • JSON API: POST https://passwordgenerator.usefulweb.site/api/v1/calculate (same calculation as this page)
  • Interface description: OpenAPI 3.1 · AI guide: llms.txt
  • MCP server (Streamable HTTP): https://passwordgenerator.usefulweb.site/mcp · tool name password_generator
Example request
curl -s -X POST https://passwordgenerator.usefulweb.site/api/v1/calculate \
  -H 'content-type: application/json' \
  -d '{"mode":"password","length":20,"count":5,"seed":"demo"}'

Related tools

  • Private Breach Checker – Check if a password appears in known breaches without revealing it (k-anonymity).
  • Key Derivation Lab – Derive keys with PBKDF2, scrypt, Argon2id and HKDF; compare costs with OWASP advice.
Feedback