Password & Passphrase Generator
Generate secure passwords and Diceware passphrases with NIST SP 800-63B entropy metrics
About Password & Passphrase Generator
How Password & Passphrase Generator Works
Generates random integers using the native browser Web Crypto API (crypto.getRandomValues), pulling characters from selected sets or words from a curated EFF dictionary. Combinatorial entropy (log2(N^L)) and brute-force resistance are evaluated client-side in memory with zero network exposure.
Password & Diceware Passphrase Generator is an on-device security and credential generation utility designed to create uncrackable, cryptographically secure passwords and human-memorable passphrases. It offers two distinct generation modes: Random Character Generation (customizable lengths, uppercase, lowercase, numbers, symbols, and ambiguous character filtering) and Diceware Multi-Word Passphrases (using a curated 1,000-word EFF-style dictionary, customizable separators, and capitalization). Each generated secret is evaluated in real time against NIST SP 800-63B Digital Identity Guidelines, displaying exact entropy in bits and estimated brute-force crack times against both offline high-performance GPU clusters (100 billion guesses/second) and rate-limited online authentication endpoints. Because random number generation relies strictly on the browser's native Web Crypto API (crypto.getRandomValues), your generated credentials never travel across a network or touch server memory.
Frequently asked questions
Is it safe to generate passwords in a web browser?+
Yes, when using DevToolkit Hub. The tool uses standard window.crypto.getRandomValues(), an operating-system backed cryptographically secure pseudorandom number generator (CSPRNG). No generated passwords, seeds, or settings are ever transmitted to an external server or logged anywhere.
What is a Diceware Passphrase and why is it recommended?+
A Diceware passphrase chains multiple random dictionary words together (such as 'Correct-Horse-Battery-Staple'). Because the words are familiar English terms, they are much easier for humans to remember and type on mobile devices than jumbled character sequences, while still providing 60-90+ bits of entropy against computerized brute-force attacks.
What are the NIST SP 800-63B password recommendations?+
NIST SP 800-63B recommends minimum password lengths of at least 8 characters (with 16+ recommended for administrative accounts), supports passphrases up to 64+ characters, discourages arbitrary composition rules that lead to predictable patterns (like 'P@ssword1'), and emphasizes high entropy.
What are ambiguous characters and why exclude them?+
Ambiguous characters are glyphs that look nearly identical in many monospace and proportional fonts: 0 (zero) vs O/o (capital/lowercase O), 1 (one) vs l (lowercase L) vs I (capital i) vs | (pipe). Excluding them prevents frustrating login typos when manually typing passwords.
Can I generate passwords in bulk for a whole team or deployment?+
Yes. Use the Bulk Generator feature to produce batches of 5, 10, or 20 passwords with one-click 'Copy All' or export to a plain text file.
Limitations
Passwords generated in the browser must be saved immediately to a secure password manager (such as 1Password, Bitwarden, or KeePass), as DevToolkit Hub intentionally retains zero history and stores nothing on disk.