Orpheus

Random Password Generator

Cryptographically random passwords, generated on your device.

Options
20
Include symbols
Allow lookalike characters

l, I, 1, O and 0 are excluded by default — they are what people mistype.

Result

Everything is processed in this tab. Nothing you paste is sent anywhere.

Every tool runs entirely in your browser. Your files are never uploaded to a server.

A strong password is long and random. Length matters far more than character variety: entropy grows linearly with length and only logarithmically with alphabet size, so twenty lowercase letters beats twelve mixed characters.

How to use Password Generator

  1. Set the length. Twenty or more for anything that matters. Longer is cheaper than more complex.
  2. Choose the character set. Symbols add a little entropy; excluding lookalikes costs almost none.
  3. Copy one. Generated with the browser’s cryptographic random source, never on a server.

About generating passwords

Password strength is entropy, and entropy has a simple formula: the log base two of the alphabet size, multiplied by the length. That relationship is the whole reason length dominates. Going from a 62-character alphabet to a 75-character one multiplies each character’s contribution by about 1.03; adding a single character multiplies the total by the full alphabet size. In practice a twenty-character lowercase password is stronger than a twelve-character one using every symbol on the keyboard, and it is far easier to type. Two implementation details matter more than they look. The random source must be cryptographic — a general-purpose random function is predictable enough to be attacked, and the difference is invisible in the output. And selecting a character by taking a random byte modulo the alphabet size introduces bias whenever 256 is not a multiple of it, quietly favouring the earlier characters; rejection sampling avoids that, which is what is used here. Beyond generation, the real weaknesses are reuse and storage. A unique random password per site, held in a password manager, defeats credential stuffing entirely — which is the attack that actually compromises most accounts, rather than anyone guessing anything.

Frequently asked questions

Are these generated on your server?
No. They come from crypto.getRandomValues in your own browser. A password generated on someone else’s server has been seen by that server and transmitted across a network — which defeats the purpose entirely, however trustworthy the site claims to be.
Does adding symbols matter more than length?
No, and by a wide margin. Entropy grows linearly with length and only logarithmically with alphabet size. Adding symbols to a 12-character password gains about 10 bits; adding four more characters gains about 26.
Why exclude characters like l, I, 1, O and 0?
Because they are the ones people mistype when reading a password from a screen or a printed sheet. Removing five characters from a 70-character alphabet costs well under one bit of entropy per character, which is a trivial price for far fewer failed logins.
Should I use a passphrase instead?
For anything you have to type from memory, yes. Four or five random words from a large list gives comparable entropy and is far easier to remember and type. Random character strings are better suited to a password manager, where you never type them at all.

Last updated