Password generator

At the same number of entropy bits they are equivalent; cracking either takes the same work. A four-word phrase is about 51 bits, which matches a random password of eight characters over the full alphabet. The difference is in use: you can memorise a phrase and retype it without a manager, while a random password wants copy and paste. To bring a phrase up to the level of a twenty-character password, take it to six words.

No, and that is deliberate. The security comes from the words being drawn at random. If you pick them, however random they feel to you, an attacker with modern tools finds them fast: they use dictionaries of proper nouns, brands and common words, and try the likeliest combinations first. Choosing the words yourself would turn a 51-bit phrase into a twenty-something-bit one, with no way for the tool to warn you.

In English, from the 7776-word list the Electronic Frontier Foundation published for this purpose: the words were picked for having no ambiguous spelling, being three to nine letters long, being easy to remember and not being offensive. We removed the four that contain a hyphen, because they clash with the separator, which leaves 7772. In Spanish there is no official EFF list, so we start from dadoware-bonito-es, curated by hand over a frequency corpus, and apply the same criteria: out go accents, proper nouns, acronyms and anything longer than twelve letters. That leaves 7286.

Yes. We use the browser’s crypto.getRandomValues(), which provides cryptographic entropy from the operating system — the same standard behind managers like 1Password or Bitwarden and Firefox’s own generator. We also make sure the distribution is uniform, across characters and across words alike: we measured it, and at ten expected draws per word the chi-squared statistic lands right where it should.

No. They are generated in your browser, shown on screen, and gone when you close the tab. You can check it with dev tools (F12 → Network): there is no outgoing request when you generate. Our anonymous analytics record the style you chose — how many words, which separator — in coarse buckets; never the phrase, never a single one of its words, nothing that could reconstruct it.

It depends. For casual accounts like forums or low-risk apps, three words or twelve characters are enough. For your main email and social networks, four or five words, or sixteen to twenty characters. For banks and password managers, five or six words, or twenty characters and up. If you use a manager, length stops being inconvenient, because you will never type it by hand.

The ones that look alike: zero and capital O, and the digit one with lowercase L and capital i. In random mode you can drop them from the whole alphabet; in phrase mode the option applies to the digits at the end, which then use only two through nine. Excluding them lowers security by a negligible amount and saves you trouble if you have to dictate the password or copy it off a screen.