How to use it
- Choose Random characters for a password, or Passphrase of words for a list of words that is easy to type and remember.
- For characters, set the Length and tick the sets to use. Tick Leave out look-alikes so that O and 0 or I and 1 are not mixed up when you read the password.
- For a passphrase, set the Number of words, the Separator and the Word list. The default is the Turkish list on a Turkish page and the English list on every other page. You can pick either.
- Press Copy next to a password, or Copy all. The page does not keep the passwords: close it and they are gone.
How the random choices are made
Each character or word is drawn with crypto.getRandomValues, the random numbers of your browser built for security. A draw is a 32-bit number. Its range is cut down to the largest whole multiple of the pool size that fits, and a number above that cut is drawn again. Without this step, some characters would come up slightly more often than others, because 2 to the power 32 is not a multiple of most pool sizes.
The character pool is the sum of the chosen sets: 26 lower-case letters, 26 capital letters, 10 digits and 24 symbols, which makes 86. With look-alikes left out, the pool is 81.
entropy (characters) = length x log2(pool size); entropy (words) = number of words x log2(list size)Entropy and the strength label
Entropy is measured in bits. A password of 20 characters from the full pool has about 128 bits. Each extra bit doubles the number of guesses needed in the worst case, if the attacker knows the length and the set of characters but not the password itself.
The labels are this page's own rule of thumb: below 40 bits weak, 40 to 59 fair, 60 to 79 strong, and 80 or more very strong. They describe guessing by brute force; a password that is in a list of common passwords is weak whatever its entropy, so never reuse one.
- A passphrase of 6 words from a 1,024-word list has 60 bits, as each word is 10 bits.
- Words are drawn at random, not chosen, so a passphrase is safe even when every word is common. Do not add a personal word or a date to it.
Worked example: 20 characters and 6 words
With all four sets and look-alikes left out, the pool has 81 characters, so a password of 20 characters has 20 x log2(81), which is about 126.8 bits: very strong.
A passphrase of 6 words from the English list of 1,024 words has 6 x 10 = 60 bits: strong. Its words are drawn at random, so the 6 words are as safe as any password of 60 bits.
Frequently asked questions
Are the passwords stored or sent to a server?
No. The passwords are made in your browser and shown on the page, and nothing is stored, sent or logged; a reload removes them, so copy the one you want first.
Why are the look-alike characters left out?
The letters O and I, the lower-case l and the digits 0 and 1 are easy to confuse when you read a password aloud or copy it by hand. Leaving them out makes the password easier to type, at the cost of a little entropy.
Which symbols are used?
The symbols are ! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : , . ? /. Quotes, the backslash and the angle brackets are left out, because many forms and programs reject them or read them wrongly.
How long should a password be?
A random password of 16 characters from all four sets has about 103 bits, which is very strong. Use a password manager, so that each account has its own password of this kind, and you need not remember them.
Is a passphrase better than a password?
It depends on the site. A passphrase of 6 to 8 words is easy to remember and has 60 to 80 bits. Some sites do not accept spaces or long passwords, so check their rules, and use the separator that they accept.
Why does the list show Turkish words?
Turkish has its own word list, with letters such as ç, ğ, ı, ö, ş and ü. A passphrase of Turkish words is as strong as an English one with the same number of words, because both lists hold 1,024 words.
Sources
Figures and text last checked on Tuesday, November 10, 2026.