Password Generator.

Yes. Passwords are generated in your browser with crypto.getRandomValues, the same source password managers use. They are never sent to a server, logged, or stored; only your settings (length, character sets) are remembered on this device.

If a password manager fills it in for you, use a long random password (20+ characters). If you have to remember or type it yourself, like a computer login or the master password of a password manager, use a passphrase of 5–7 random words.

Aim for at least 80 bits of entropy: about 14 random characters using all four character sets, or 6 words from the EFF list. The strength meter shows the entropy of your current settings.

Entropy is length × log2(number of possible characters) for passwords, and words × log2(7,776) for passphrases. The time estimate assumes an offline attack at 100 billion guesses a second, which is pessimistic; a site that stores passwords properly makes guessing far slower.

It leaves out characters that are easy to confuse when reading or typing a password by hand: capital I, lowercase l, the digit 1, capital O, lowercase o and the digit 0. It lowers entropy slightly, so add a character or two.

In a password manager, with a different password for every site. Pumpkins Vault is a free, end-to-end encrypted option: your passwords are encrypted in the browser before they are saved.