Password Lab: Password and passphrase generator
NewGenerate strong passwords and memorable passphrases, with the entropy of every option shown in bits.
…
Options
Randomness you can check
Every value comes from the browser's cryptographic random number generator, and the entropy shown is calculated from the settings you picked rather than a vague strength score.
Cryptographic randomness
Values are drawn with crypto.getRandomValues and unbiased rejection sampling, not Math.random.
Entropy in bits
See the exact bit count for your length, character sets, and word count before you commit to a password.
Readable passphrases
Three to ten words with your own separator — easy to type on a phone or read out loud, hard to guess.
Look-alike filter
Drop l, I, 1, O, 0, and o when a password will be printed, dictated, or typed from a screen.
Batch generation
Produce five at once when you are setting up several accounts or seeding a team vault.
Nothing leaves the page
No request is made when a password is generated, and nothing is stored in the browser after you close the tab.
Questions about passwords
Are the generated passwords stored anywhere?
No. They are created in your browser's memory and disappear when you close or reload the page. There is no server call, no logging, and no local storage.
Is Password Lab free, and does it work offline?
Yes. Password Lab is free, with no account, no sign-up, and no usage limit. It runs entirely in your browser, so once you have opened the page while online, it keeps working without a connection.
How long should a password be?
For a password mixing four character sets, 16 characters is a reasonable floor and 20 or more is comfortable. Rather than a fixed number, use the entropy readout: aim for 100 bits or more on accounts that matter.
Is a passphrase weaker than a random password?
Not necessarily. Strength depends on entropy, not on whether the result looks random. Each word from the fixed 512-word list adds 9 bits, so a six-word passphrase carries about 63 bits — increase the word count when you need more.
Why exclude look-alike characters?
Because l, I, 1, O, 0, and o are easy to confuse in most fonts. Excluding them shrinks the pool slightly, which the entropy figure accounts for, and prevents failed logins when a password is read from a screen or a printout.
Should I reuse one strong password everywhere?
No. One breach would expose every account. Generate a separate password for each service and keep them in a password manager.
Does this check whether a password was breached?
No. Checking against a breach corpus would require sending data off your device, which this Lab deliberately does not do.
Where to go next
The Labs people most often reach for straight after this one.