Runs locally with the Web Crypto API. No requests, no logging, no storage. Open DevTools, watch the Network tab, and generate all you want. Nothing happens.
Don't trust this page? Verify it yourself and run the offline copy.
How this password generator works
Every password and passphrase is created on your device. When you click generate, the tool calls window.crypto.getRandomValues(), the browser's cryptographically secure random number generator, and uses rejection sampling so every character or word is equally likely. It never uses Math.random(), which is not safe for secrets.
Nothing you generate is sent anywhere. There is no server call, no analytics, and no storage. The strength meter is powered by zxcvbn-ts, which also runs locally in your browser. You can confirm all of this yourself. Open your browser's developer tools, watch the Network tab, and generate as many passwords as you like.
There is also a downloadable offline version, a single HTML file with the same code, both wordlists, and the strength library all inlined. It is byte-for-byte the same logic that runs here, and it works with no network connection at all. You can get it, along with the deeper material on passphrases, entropy, and storing passwords safely, from the password security guide.
Common questions
Is this password generator really offline?
Yes. Every password and passphrase is generated in your browser using the Web Crypto API. Nothing you generate is sent to a server. You can verify this in DevTools under the Network tab, or download the offline version and run it with no internet connection at all.
What's the difference between the EFF Large and Short wordlists?
The EFF Large wordlist has 7776 words and gives about 12.9 bits of entropy per word. The Short wordlist has 1296 words, gives about 10.3 bits per word, and uses shorter, more memorable words that are easier to type. Large is stronger per word; Short is easier to remember.
How many words should my passphrase have?
Six words from the EFF Large wordlist gives about 77 bits of entropy, which is strong for almost anything. Use seven or eight words for high-value accounts like your email, password manager, or financial logins.
Can I trust the randomness?
This tool uses window.crypto.getRandomValues(), the browser's cryptographically secure random number generator. It never uses Math.random(). Word and character selection uses rejection sampling so every option is equally likely, with no modulo bias.
Do you log or store generated passwords?
No. Nothing is logged, stored, or transmitted. There is no analytics, no cookies, and no persistence. When you close the tab, the generated values are gone.
Can I use this on my phone?
Yes. The tool works in any modern mobile browser. The copy button works on touch devices, and the downloadable offline version can be saved and opened from your phone's files with no connection.
Built by Blackout VPN
Open DevTools and watch the network tab. Nothing leaves this page. Our VPN is built on the same rule as this generator. Nothing collected, nothing stored, nothing to hand over when someone comes asking. $30 covers 3 months, less per month on yearly, no account needed.
No email list here. Follow the blog by RSS or find us on Mastodon.