What this password generator cannot do

It generates, and that is all it does

There is no vault here. Nothing is saved, synchronised, filled into a form, or recoverable after you leave. That is a deliberate limit rather than a missing feature: storing credentials is a different product with a different threat model, and a generator that quietly kept a copy of everything it produced would be a worse tool, not a richer one.

A consequence worth stating plainly: there is no history. Press Generate and the previous value is gone. If you did not copy it, it does not exist anywhere.

It also does not check a password against breach databases, score one you already have, or tell you whether an account of yours has been exposed. Those all require sending something somewhere, and this page sends nothing.

What a strong passphrase does not protect you from

Guessing is only one way an account is lost, and for most people it is not the likeliest. A passphrase of any strength is no defence against a convincing phishing page, because you hand it over yourself. It is no defence against malware on your machine, which can read what you type and what is on your clipboard.

It is no defence against a website that stores passwords badly. If a service keeps yours in plain text or behind an obsolete hash and is then breached, the strength of what you chose stops mattering at the moment of the leak.

And it is no defence at all against reuse. One strong passphrase across ten sites is one breach away from being a problem at all ten. This is the failure mode that actually affects people, and the fix is a different password per account, which in practice means a password manager.

Two-factor authentication covers a good deal of what a password cannot. Where a service offers it, turn it on; it matters more than the last ten bits of entropy.

Limits of the entropy figure

The number shown describes the settings, not the particular passphrase on screen. It assumes an attacker who knows the list, the word count, the length range, the separator and the case rule — all of which are published on this page — and is guessing only the random draws.

Time estimates rest on an assumed guessing rate, stated wherever they appear. Change the assumption and the times change by orders of magnitude. They are useful for comparing settings against each other, and much less useful as predictions.

The figure also assumes the browser’s random number generator is sound. This page refuses to run without a cryptographic source, but it cannot audit that source from inside the page.

When to use something else

On a device you do not control or do not trust — a shared computer, a public terminal, a machine you suspect is compromised — do not generate a credential in a browser at all. Anything on that screen is readable by whatever else is running there.

For high-assurance work such as encryption keys, signing keys, or credentials governed by an organisation’s security policy, use the tooling that policy specifies. ToolAcre generates passwords locally in your browser. For highly sensitive environments, verify your browser, device and operating system are trusted before using any web-based password generator.

If you need a passphrase in a language other than English, this page cannot help: all three lists are English, and a phrase in a language you do not speak is no easier to remember than random characters.

If you need dozens of passwords at once, or the same passphrase reproduced from a seed, a command-line tool is the better fit. This page produces one value at a time, on purpose.

Where the words come from

All three word lists shipped with this page are the published Electronic Frontier Foundation word lists, used under CC BY. The long list holds 7,776 words; the two short lists hold 1,296 words each.

One change has been made to the files. The EFF publishes them with two columns — a five-digit dice roll and then the word — and the dice-roll column has been removed, because this page draws with the browser’s random number generator rather than with dice. The words themselves are unchanged, in the same order.

ToolAcre is not affiliated with, endorsed by, or sponsored by the Electronic Frontier Foundation. The lists are used and attributed under the terms of their licence, which is exactly what that licence provides for.

• The EFF’s word lists for random passphrases — the creators’ own page, explaining how each list was built and why.
• The Creative Commons Attribution licence — the licence the word lists are used under.

What happens to what you generate

ToolAcre generates passwords locally in your browser. For highly sensitive environments, verify your browser, device and operating system are trusted before using any web-based password generator.

• Every passphrase and password is generated in your browser tab, by your browser’s own cryptographic random number generator. No server is involved once the page has loaded.
• Nothing generated here is sent to ToolAcre. This product’s Content-Security-Policy restricts the page to its own origin, so the browser itself blocks any attempt to send data elsewhere.
• Nothing is written to local storage, session storage, a cookie, an in-browser database, the address bar or the browser console. Reloading discards it; closing the tab discards it.
• There is no account, no sign-in, no analytics script and no advertising script. The only files downloaded are the static word lists.
• No history is kept. Generating again replaces the value, and the previous one is not recoverable.

Questions

Limitations

• No storage, no sync, no autofill and no history. The page generates a value and forgets it.
• No breach checking and no scoring of passwords you already have, because both would require sending data off the device.
• English word lists only — the three published EFF lists, used under CC BY with the dice-roll column removed and the words unchanged.
• One value at a time. There is no bulk generation and no reproducible seed.
• The entropy figure is an estimate about the settings under stated assumptions, not a guarantee about any particular passphrase.
• Nothing here helps against phishing, malware, password reuse, or a service that stores your password badly.
• Clipboard access can be refused by the browser or an extension, in which case you must select and copy the text yourself.