Password generator computed on your device and nowhere else
The fifty-seven other tools
The random-draw trap is silent
It’s the most common flaw in these tools, and it can never be seen by eye. To pick one character out of seventy, you draw a byte, which is worth 0 to 255, and many tools simply take the remainder of the division. The problem is that 256 isn’t divisible by 70: the first characters of the set come up more often than the last ones.
The announced entropy then doesn’t quite exist, and nothing shows it: the password looks as random as any other. Here, draws that would fall into the unbalanced zone are discarded and redone. This is measured, and the measurement can be rerun at will from the project’s test bench.
The passphrase draws from exactly 256 words
It isn’t a round number for the sake of it. 256 words give exactly eight bits per word, which makes the entropy calculation exact instead of approximate. A word list of 250 or 300 words would force us to state a rounded value, and so to lie a little.
Five words are therefore worth exactly forty bits, and you can check that in your head. The generator refuses to run if its word list isn’t exactly 256 distinct words: a wrong entropy is a false result, and nothing on the page would show it.
Password or passphrase
A password is shorter and denser. It suits anywhere you never type it by hand, because a password manager takes care of it.
A passphrase is longer and much easier to remember and retype. It suits what you type yourself: a password manager’s master password, a work session, disk encryption, a protected archive.
For the same number of bits, the two are equal. The choice depends on the use, not on the strength.
What entropy means, in plain words
It’s the number of bits of uncertainty for someone trying to guess. Each bit doubles the number of attempts needed. As a rough guide: below 50 bits is short, 60 to 80 is comfortable for an ordinary account, and beyond 90 is needlessly strong for everyday use.
That number only holds for a secret that is truly drawn at random. A password chosen by a human, even a complicated one, is worth much less than its length suggests: that’s exactly why these generators exist.
Nothing is saved and nothing is transmitted
The secret is made in your browser by the system’s cryptographic generator. It isn’t sent, kept or written to the browser’s storage. Leaving the page erases it for good: write it down or save it in your password manager before you go.
Frequently asked questions
Is my password sent anywhere? No. It’s made in your browser by the system’s cryptographic generator, and it doesn’t leave.
Is it saved in my browser? No. Leaving the page erases it for good: write it down or save it in your password manager before you go.
Why does the word list have exactly 256 words? Because 256 words give exactly eight bits per word, which makes the entropy calculation exact instead of approximate.
How many bits should I aim for? Below 50 bits is short, 60 to 80 is comfortable for an ordinary account, and beyond 90 is needlessly strong for everyday use.
Should I prefer a password or a passphrase? For the same number of bits, the two are equal. A passphrase suits what you retype yourself; a password suits what a password manager remembers for you.
Wize