Turn on “avoid look-alikes” for passwords you need to read aloud or type from paper. Generate ten at once to pick one that a fussy website will accept.
How the passwords are made
PassphraseKit draws every character, word and digit with crypto.getRandomValues, the browser’s cryptographically secure random number generator, the same source used for encryption keys. To keep each choice exactly uniform it uses rejection sampling: random numbers that would make some characters slightly more likely than others are thrown away and drawn again. The page makes no network requests while generating, and generated passwords are never written to storage. Only your settings, such as length and character types, are remembered on this device.
Random character passwords pick from the character types you select and are regenerated until they contain at least one character of each type, which satisfies most website rules without making any position predictable. Passphrases pick words from the EFF large wordlist of 7,776 words, published by the Electronic Frontier Foundation under a Creative Commons Attribution licence, so each word adds log₂ 7,776, about 12.9 bits.
Reading the strength meter
Entropy measures how many equally likely possibilities a generator could have produced. A 16-character password from 62 letters and digits has about 95 bits; a five-word passphrase about 65 bits; a six-digit PIN about 20 bits. Every extra bit doubles an attacker’s work. The crack-time estimate assumes ten billion guesses per second, a realistic rate for a stolen database protected by a fast hash; slow password hashes and online logins are millions of times slower. These figures apply to generated passwords, where the method is known but the randomness is not.
Checking a password you already have
People are poor at randomness, so a typed password is weaker than its length suggests. The strength checker gives a rough, cautious estimate: it counts length and character types, then discounts repeats, sequences like 1234 or qwerty, and common passwords even when letters are swapped for symbols. It is a guide, not a guarantee; the safest fix for a weak password is a fresh one from the generator, stored in a password manager and used on one site only.
Frequently asked questions
Are symbols necessary?
Length matters more. A 20-character password of letters and digits is far stronger than a 10-character one with symbols.
Why does a site reject my password?
Some sites limit length or certain symbols. Turn symbols off or shorten the length and generate again.
Should I reuse a strong password?
No. Use a different password on every site and keep them in a password manager.
Is PassphraseKit free?
Yes, with no sign-up. Only your settings (length, options) are remembered on this device.
Are generated passwords stored?
No. They exist only on the page until you close or regenerate it.