Password & Passphrase Generator

Sixteen characters is a sensible floor for anything with money or email behind it, and twenty or more for a password manager's master password — the one that guards all the others. The reason is arithmetic rather than fashion: each extra character multiplies the number of possibilities by the size of the character set, so adding one character to a mixed-case alphanumeric password makes it about 62 times harder to guess, while adding a symbol to a short one barely moves the number. If a site caps you at twelve characters, use the full twelve and turn on two-factor login, because that cap tells you something unflattering about how they store passwords.

Yes, when the words are chosen randomly by a machine and there are enough of them. Four words picked at random from a list of 115 give about 27 bits, which is not enough; six words give around 41 bits, and the passphrase mode here shows you the number rather than making you guess. What destroys a passphrase is choosing the words yourself — human-chosen words cluster around a few thousand common ones and follow grammar, which attackers model directly. The real advantage of a passphrase is not strength, it is that you can retype it from memory on a television remote.

It depends entirely on where the generation happens, and that is a question worth asking of every free online tool of this kind. This one runs completely in your browser using the Web Crypto API, so the password exists only on your device and is never transmitted to us — there is nothing on our side to log, leak or subpoena. A generator that produces the password on its server has, by definition, seen it. If you cannot tell which kind you are using, assume the worse one, or use the generator built into your password manager.