DNSprobe
DNSprobe
CPU
--
MEM
--
Uptime
--
Temp
--

Password & passphrase generator

Create strong, random, and memorable secrets — generated locally in your browser.

Local generation Entropy indicator TXT/CSV export

Generator Options

Passphrase wordlists
Status: not loaded

Result:

Estimated Strength: - bits

User guide for the password and passphrase generator

How does the generator work?

The tool produces random secrets based on parameters you define. It can generate either a classic password or a passphrase made of multiple random words.

Available parameters

  • Password length or number of words for a passphrase.
  • Character sets: lowercase/UPPERCASE, digits, symbols.
  • Passphrase options: separator (dash, dot, space, etc.), word casing, optional digits and symbols.
  • Exclude ambiguous characters (e.g., 1/l/I, 0/O/o) to improve readability.
  • Wordlists: English, French, with optional accent normalization.

Strength measurement

The strength bar is based on a client-side entropy estimate (length × log₂ of the alphabet size). This offers a quantitative indication of guess resistance.

Privacy

Passwords are generated locally in your browser; the tool neither transmits nor stores them.

1) Choose the mode

Activate “Passphrase mode” to create a sequence of random words (easier to remember), or keep the classic mode for a random password (letters, digits, symbols).

2) Set the length

  • Password: aim for at least 16 characters (20 to 24 recommended).
  • Passphrase: select 4 to 7 random, unrelated words.

3) Customize

  • Character set: lowercase/UPPERCASE, digits, symbols.
  • Separator (passphrase): dash, dot, space, slash, etc., to improve readability.
  • Word casing (passphrase): first-letter uppercase, all lowercase, all UPPERCASE, or random.
  • 1337 style (optional): may help with strict complexity rules, but length remains the priority.
  • Exclude ambiguous characters: makes entry easier and avoids visual confusion.

4) Generate, assess, copy

  • Click “Generate” and then check the entropy (strength bar).
  • Copy in one click, or download the list as TXT/CSV.

Best practices for strong passwords

  • Prioritize length: 16+ characters (or 4–7 random words) offer much better resistance.
  • Use a unique secret per service: never reuse a password.
  • Avoid personal information: first name, birthdate, pet name, etc.
  • Avoid sequences and common terms: “qwerty or azerty”, “1qaz2wsx”, “123456”, “password”, etc.
  • Mix character types (outside passphrases): letters, digits, symbols.
  • Use a password manager for secure storage and autofill.
  • Enable two-factor authentication (2FA) whenever available.
  • Change immediately if a breach is suspected or confirmed.
About entropy. Target around 80 bits for general use and 100 bits or more for sensitive accounts. Length increases entropy more reliably than predictable substitutions.

Understanding the zxcvbn indicator

On the left of the "Copy" button you’ll see a zxcvbn evaluation for each password. It appears in three stacked lines: (1) the score, (2) a readable strength label, (3) an estimated crack time.

zxcvbn is an open-source library developed by Dropbox. Instead of only counting length or possible characters, it estimates password strength by simulating realistic attacks using dictionaries, keyboard patterns, substitutions, and repetitions.

How to read the block

  • Score (zxcvbn: 0–4) — 0–1 = weak, 2 = fair, 3 = good, 4 = very good.
  • Strength label — A human-readable summary (Weak, Fair, Good) matching the numeric score.
  • Estimated time — Estimated time to crack the password (e.g. “centuries”, “3 hours”) under several attacker models.

How zxcvbn computes the score

  • Comparison with dictionaries (common words, names, multi-language lists).
  • Detection of keyboard patterns (e.g. “qwerty”) and simple sequences (e.g. “12345”).
  • Recognition of “l33t” substitutions (e.g. “p@ssw0rd” ≈ “password”).
  • Identification of dates/years and easy combinations (e.g. “1990-05-01”).
  • Penalties for repeats and simple concatenations (e.g. “aaa”, “passpass”, “pass1”, “pass2”).

zxcvbn is empirical (pattern-based) while the entropy shown above is theoretical (alphabet size × length). They can differ — this is expected.

Performance: zxcvbn runs client-side. To avoid blocking the UI we run it in a Web Worker (or in-page as fallback) and may limit analysis to the first N results if needed.

Frequently asked questions

A passphrase is often easier to remember for equivalent strength because its length adds significant entropy. A random password is ideal when using a manager.

No. Passwords are generated locally in the browser. The tool does not transmit or store these data. Any download (TXT/CSV) is at the user’s discretion.

Simple substitutions (a→4, e→3, etc.) add little randomness and remain predictable. Length is the decisive factor for overall strength.

There is no need to rotate a long, unique, strong password on a schedule. However, change it immediately in case of a breach, security alert, or doubt. Enabling 2FA is strongly recommended.

Yes, because it helps generate and store unique passwords for every site. This avoids having to memorize them or reuse the same ones.

Experts recommend at least 12 to 16 characters for a password, and even longer if it protects sensitive data.

Yes, a password that mixes uppercase, lowercase, numbers, and symbols increases the search space, making brute-force attacks harder.

Yes, a passphrase made of several random words (e.g., “table-sky-mango-car”) can provide more entropy and be easier to remember.

No, it’s one of the worst security practices. If one site is compromised, all your other accounts become vulnerable.

Technically no, but some services impose a limit (often 64 or 128 characters). Longer = safer, as long as the service accepts it.

Not always. You should use a client-side generator (like this one) that never sends anything over the Internet. Otherwise, your passwords could be intercepted.

Yes, 2FA (via app, hardware key, or SMS) adds an extra layer of protection. Even if the password is stolen, the account remains secure.

Entropy is a theoretical measure of randomness. zxcvbn simulates real-world attacks (dictionaries, keyboard patterns). Results may differ, which is expected.

No, they complement them. Fingerprint or facial recognition is convenient authentication, but behind the scenes there is often still a master password.
⚙️ Configuration