# Password Generator

> Generate strong random passwords, EFF-wordlist passphrases and PINs with crypto.getRandomValues. Runs 100% offline — nothing you generate leaves the page.

- URL: https://bytescope.dev/en/password-generator/
- Locale: en · Also: [ja](https://bytescope.dev/ja/password-generator.md) · [zh-Hant](https://bytescope.dev/zh-Hant/password-generator.md)
- Runs: Everything runs locally in your browser — nothing is uploaded.
- Requires: Any modern browser (Chrome, Edge, Firefox, Safari), desktop and mobile.
- Updated: 2026-09-08

## What it does

This password generator runs entirely in your browser and uses `crypto.getRandomValues` — the cryptographically secure random number generator built into your browser — never `Math.random`. Pick a character set (upper/lower case, digits, symbols, with an option to exclude easily-confused characters like `0`, `O`, `1`, `l`, `I`), set the length, and generate as many candidates as you need at once.

Prefer something you can actually remember? Passphrase mode draws 4–8 words from the EFF long wordlist — the "correct horse battery staple" approach — which trades a longer string for far easier memorization at equivalent strength. A PIN mode covers numeric codes. Every result shows its entropy in bits alongside a plain-language estimate of how long an offline brute-force attack would take.

Unlike most online password tools, this page loads no third-party generator scripts and the generator itself makes zero network requests — you can verify in your browser's DevTools Network tab that generating a password sends nothing. (The only requests on the page are the site's cookieless page-view beacon, which carries no generated data.) Generated passwords are held only in memory: nothing is stored, and refreshing the page erases the history.

Need characters the built-in sets don't cover — a specific symbol, a character a site requires, or a non-Latin script? A custom-characters field adds anything you type to whichever built-in sets are enabled (duplicates are removed automatically, and the entropy estimate always reflects the true, deduplicated pool size, so the numbers stay honest). Generating for a team or a batch of new accounts? An Export CSV button turns the current batch of N results into a downloadable spreadsheet — built entirely in your browser with a Blob download, so the same nothing-uploaded guarantee covers the exported file too.

## Limits

Does not store, sync or check passwords against breach lists; it only generates them.

## FAQ

### Can I add my own characters to the pool?

Yes — the custom-characters field adds whatever you type to whichever built-in sets you've enabled (or stands alone if you leave every toggle off). Duplicate characters are removed automatically, and the entropy and crack-time estimates are always computed from the actual deduplicated pool, so enabling it never inflates the numbers.

### Can I export a batch of generated passwords?

Yes — the Export CSV button turns the current batch (however many you generated at once) into a downloadable .csv file with columns for the password, its entropy in bits, and its strength rating. The file is built entirely in your browser via a Blob download; nothing is uploaded to produce it.

### Is it safe to generate a password on a website?

It depends entirely on where the randomness comes from and where the result goes. This page generates passwords with your browser's built-in CSPRNG (crypto.getRandomValues), and the generator makes zero network requests — generating and copying a password sends nothing anywhere, so the password exists only on your machine. You can confirm with the DevTools Network tab: the only traffic on this page is the site's cookieless page-view beacon, which never sees your passwords.

### Why crypto.getRandomValues instead of Math.random?

Math.random is a fast pseudo-random generator designed for games and animations — its output is predictable enough that it must never be used for secrets. crypto.getRandomValues is a cryptographically secure random source seeded by the operating system, which is what password generation requires.

### What is a passphrase and when should I use one?

A passphrase strings together random words from a fixed wordlist (this tool uses the EFF long list: 7,776 words, ~12.9 bits of entropy per word). A 5-word passphrase (~64 bits) is comparable in strength to a 10-character mixed-symbol password but is far easier to type and remember — ideal for master passwords you must memorize.

### How is the crack-time estimate calculated?

From the entropy: a password chosen uniformly from N possibilities takes on average N/2 guesses. The estimate assumes an offline attacker testing 10 billion guesses per second (a realistic GPU rig against fast hashes) — real times vary hugely with how the service stores passwords, so treat it as an order-of-magnitude guide.

### Are generated passwords stored anywhere?

No. Results live only in this tab's memory so you can compare a few candidates; there are no cookies, no localStorage entries, and nothing is sent anywhere. Reloading the page clears everything.