Alphanumeric password
A strict 62-character alphabet: Latin letters in both cases and digits. Such a password is accepted by any system, including the fussiest.
Space — new password · C — copy · M — hide
Password length
Character sets
Select at least one character set.
Passphrase settings
A 2048-word list gives exactly 11 bits per word (the Diceware method). Six words are 66 bits, eight are 88. The words are drawn by a cryptographic generator, not by a human — that is the whole point.
Password pattern
a — lowercase, A — uppercase, L — any letter, 9 — digit, # — symbol, X — letter or digit, * — any enabled character, c/v — consonant/vowel. Every other character is copied as is, \ escapes the next one.
Fine tuning
“Safe symbols only” keeps !@#$%^&*_-+=? — almost every site accepts them and they do not break shell commands, CSV or SQL.
Recent passwords (this tab only)
What happens to your password
The password is assembled in your browser from the cryptographic randomness source crypto.getRandomValues with rejection sampling, so every character is equally likely.
The page never sends passwords to a server, never writes them to browser storage and drops the history when the tab closes.
Password letter by letter
Phonetic spelling for reading a password out over the phone. Letter case is stated separately.
Where this is mandatory
Some systems turn the password into part of something else: an API key in a query string, a database name, a value in a configuration file, a command-line argument.
There a punctuation mark risks being read as a separator, a quote as the start of a string, an ampersand as a new parameter. The password is stored correctly but does not work everywhere, and debugging takes hours.
A strict 62-character alphabet removes that whole class of problems.
How many characters to take
Each character carries 5.95 bits. Twelve give 71 bits, sixteen give 95, twenty give 119, thirty-two give 190.
For service passwords and keys take twenty or more: they are never typed by hand, and in a configuration file length costs nothing. For an ordinary account sixteen is plenty.
If the system does accept punctuation but you are unsure which characters, use the “safe symbols only” filter on the main page: it keeps the set that almost everything accepts.
Questions
Frequently asked questions
Who needs exactly this?
Systems where the password becomes part of something else: an API key, a database name, a value in a configuration file, a command-line argument. There any punctuation risks being read as a separator or a control character.
How many characters should I take?
With 62 characters each one carries 5.95 bits. Twelve give 71 bits, sixteen give 95, twenty give 119. For keys and service passwords take twenty or more — they are never typed by hand anyway.
How is this different from “without symbols”?
Technically it is the same restriction seen from the other side. The difference is the reason: here a system demands a strict format, rather than a sign-up form being badly written.
Next