Password Generator
A strong password in one click — made in this tab, never sent anywhere.
20 characters · tap the number to type an exact length.
Set a length and press Generate. The value is created in this tab with the browser’s crypto source, and it disappears when you close the page.
01 Capability
What it does
Small details that make the job quicker.
- Uses crypto.getRandomValues with rejection sampling, not Math.random and not a modulo shortcut that quietly favours some characters.
- Guarantees at least one character from every type you enable, then shuffles the whole result securely.
- Shows an honest entropy estimate in bits plus a plain strength label, instead of a fake five-bar meter that always looks full.
- Offers a passphrase mode built from a fixed 320-word list, with a separator, capitalisation and an optional two-digit number.
- The avoid-look-alikes option removes 0, O, 1, l, I and o so a password can be read aloud or typed from paper.
- Nothing is saved, logged or checked against a breach service. The password exists only in this tab until you close it.
02 Questions
Questions
Short answers, no small print.
Is a password made here actually random?
Yes. Every character comes from your browser's crypto.getRandomValues, which is designed for security, and the helper rejects values that would bias the result. It does not use Math.random. The only predictable part is the rule that each enabled character type appears at least once.
How is the entropy number calculated?
For a password it is the length multiplied by the base-2 logarithm of the pool size, for example 24 characters from an 89-character pool is about 155 bits. For a passphrase it is the number of words multiplied by the logarithm of the 320-word list, plus about 6.5 bits if you add a number. It is an estimate of the randomness, not a guarantee about how an attacker will behave.
Why does it not check whether the password has been breached?
A breach check would have to send a fingerprint of your password to another service. Astra does not make that request. If you plan to use the password for a real account, paste it into the breach checker you trust after you have saved it, not before.
Can I get the same password again?
No, and that is deliberate. Astra keeps no history and writes no cookie or local-storage entry for the password. Generate a new one if you lose it, then update the account. The Copy button is there so you can move it straight into a password manager or the account form.
Which is better, a password or a passphrase?
A long random password is strongest per character and is best kept in a password manager. A passphrase is easier to type from memory, but each word adds only about 8.3 bits with this list, so use seven or more words. Seven words plus a number is roughly 65 bits; eight words is about 73 bits.
What does avoid look-alikes change?
It removes the characters that are easy to confuse when read aloud or copied by hand: zero and capital O, one, lowercase l, capital I and lowercase o. The pool gets smaller, so the entropy estimate drops slightly. Turn it off when the password only ever goes into a password manager.