Password by pattern
A mask sets the shape: where letters go, where digits go, where the dashes are. Handy for keys, promo codes and systems with a strict format.
Space — new password · C — copy · M — hide
Password length
Character sets
Select at least one character set.
Passphrase settings
A 2048-word list gives exactly 11 bits per word (the Diceware method). Six words are 66 bits, eight are 88. The words are drawn by a cryptographic generator, not by a human — that is the whole point.
Password pattern
a — lowercase, A — uppercase, L — any letter, 9 — digit, # — symbol, X — letter or digit, * — any enabled character, c/v — consonant/vowel. Every other character is copied as is, \ escapes the next one.
Fine tuning
“Safe symbols only” keeps !@#$%^&*_-+=? — almost every site accepts them and they do not break shell commands, CSV or SQL.
Recent passwords (this tab only)
What happens to your password
The password is assembled in your browser from the cryptographic randomness source crypto.getRandomValues with rejection sampling, so every character is equally likely.
The page never sends passwords to a server, never writes them to browser storage and drops the history when the tab closes.
Password letter by letter
Phonetic spelling for reading a password out over the phone. Letter case is stated separately.
Syntax
How a mask is read
| Symbol | What it becomes |
|---|---|
| a | lowercase letter |
| A | uppercase letter |
| L | any letter |
| 9 | digit |
| # | symbol from the enabled set |
| X | letter or digit |
| * | any character from the enabled sets |
| c / v | consonant / vowel — for pronounceable chunks |
| C / V | the same in uppercase |
| \ | escapes the next character: \9 yields a literal 9 |
Every other character — hyphens, dots, brackets — is copied into the result as is and adds no entropy.
Where it helps
Ready-made shapes
Promo codes and coupons. XXXX-XXXX-XXXX is the familiar shape: easy to dictate and neat in a spreadsheet. A batch of them is best made in bulk generation.
Serial keys. AAAAA-99999-AAAAA-99999 gives a recognisable format and enough length that the key cannot be guessed.
Readable passwords. Cvcvcv-99# builds a pronounceable chunk from consonants and vowels, then adds digits and a symbol — handy when the password has to be read out.
A corporate standard. If policy demands “one capital, four lowercase, two digits, one symbol”, the mask Aaaa99# produces exactly that. Remember, though, that a rigid format narrows the search space, and the dial shows the lost bits honestly.
Questions
Frequently asked questions
How is a mask written?
a is a lowercase letter, A uppercase, L any letter, 9 a digit, # a symbol, X a letter or digit, * any character from the enabled sets, c and v a consonant and a vowel. Every other character is copied as is, and a backslash escapes a control character.
Does a pattern reduce strength?
It does, and the calculator says so honestly: fixed separators add no entropy. The mask Aaaa-9999-aaAA yields about 51 bits — too little for an important account, plenty for a promo code.
Next