FREN

Security / Tool

Home / Security

Password and passphrase generator

Generate easy-to-remember passphrases or random passwords, with their real strength expressed in bits of entropy and cracking time. The randomness is cryptographic and everything stays in your browser.

Security Tool All levels Published October 20, 2026 Translated October 27, 2026 2 min read Version française
Computer keyboard lit in blue
Photo: Katharina Gloth on Unsplash

Before you start

In plain words

A good password is not "complicated", it is unpredictable. Five randomly drawn words separated by digits or symbols ("Horse7Lamp#Thirst@Gallery2Dawn") are much harder to guess than P@ssw0rd!, easier to remember, and accepted by sites that require an upper-case letter, a digit and a special character. The tool draws at random with your browser's cryptographic generator: nothing is sent, nothing is kept.

Passphrase or password?

Use Recommended choice
Master password of the password manager, computer login, disk encryption Passphrase of 6 words or more: you have to remember it and type it
Online accounts stored in a password manager Random password of 20 characters or more: you never type it, the manager fills it in
Site that limits length or characters Random password at the maximum length allowed

How strength is calculated

Entropy measures the number of possibilities an attacker has to try, assuming they know the method (the wordlist, the characters used). Each bit doubles the number of attempts.

  • Passphrase: the English version uses the EFF large wordlist, designed for passphrases: 7,772 words (the 4 words containing a hyphen have been removed). Each word adds almost 13 bits.
  • Random separators: each separator is drawn from 10 digits and 10 special characters accepted everywhere (!#$%&*+=?@), with at least one digit and one symbol guaranteed. They add a little over 4 bits each: 5 words separated this way give about 82 bits, more than 6 words separated by hyphens (about 78 bits).
  • Password: roughly length × log₂(number of possible characters). 20 characters out of about 80 give about 126 bits. The tool guarantees at least one character of each ticked type and counts exactly the combinations that follow this rule. The list of special characters can be edited for sites that reject some.
  • The capital at the start of each word is applied to every word: it satisfies sites that require one, but adds no entropy.

The times shown correspond to half of the combinations, on average, at three attack speeds: an online site that limits attempts, a stolen password database well protected by slow hashing, and a poorly protected database attacked with a rack of graphics cards.

One password per account

Even a perfect password falls as soon as one of the sites where it is reused is hacked. Use a password manager and turn on two-factor authentication wherever possible: see Two-factor authentication and FIDO2 keys.

Sources

Read next