# Password Generator

Generate a strong random password or passphrase in your browser, with the strength shown in bits rather than a badge. Nothing is sent anywhere.

Canonical page: https://filetity.com/password-generator

## Capabilities

- Free: Yes, with no watermark and no page limit.
- Account required: No. There is no account system.
- Processed on device: Yes. The file is read by your browser and never uploaded. There is no server to send it to.
- Formats: Nothing goes in. Out comes a password of 6 to 64 characters, or a passphrase of 3 to 12 words.
- Limits: No limit worth naming. Ten at a time if you need a batch, and none of them is stored, logged or recoverable once the page is closed.
- Mobile: Yes, on any modern mobile browser. Large files are limited by the memory the phone gives the browser.
- Offline: Yes, once the page has loaded. The tool keeps working with no network connection.

## Questions

### What is a bit of entropy, and why not just say strong?

Bits count how many guesses it takes. Each bit doubles the work, so 40 bits is a trillion guesses and 80 bits is a trillion times that. Strong is a rule about shape: a capital, a digit, a symbol. A twelve character password that passes every one of those rules is 71 bits, and six random words that pass none of them is 48 bits and far easier to remember. The rules describe what a password looks like; the bits describe how hard it is to find.

### Is a passphrase actually safe, if the words are ordinary?

Yes, as long as the words are chosen randomly and there are enough of them, and the second half is where most generators quietly cheat. This list holds exactly 256 words, so each one is exactly 8 bits: ten words is 80 bits, and six words would be 48, which falls in about twenty three minutes at the attacker rate this page states. So the default is ten. Diceware needs only six because its list is 7,776 words. A short list is not weaker, it is longer for the same strength, and the number is on screen either way. What is genuinely unsafe is a phrase you invented yourself, because a phrase a person thought of is not random.

### Is the password sent anywhere, or saved?

Neither. It is generated in the page and lives in the tab until you close it. There is no server here to send it to and no storage to write it into, which is checkable: open the network tab while you press the button and nothing goes out. Copying it puts it on your clipboard, which is the one place it does leave this page.

### Should I turn off symbols?

Only when something refuses them, and plenty still does: bank sites, old routers, and anything that will be typed on a TV remote. Dropping symbols costs about a fifth of the strength per character, so add three or four characters to the length and you are back where you were. That is the trade the meter is showing while you toggle it.

## Related tools

- [UUID Generator](https://filetity.com/uuid-generator): Generate v4 or time ordered v7 UUIDs, and read the version out of one you have.
- [Character Counter](https://filetity.com/character-counter): Count characters and words live, against the limits you are writing for.