A weak or reused password remains one of the most common ways accounts get compromised. This tool generates genuinely random passwords and passphrases using your browser's cryptographically secure random number generator — the same class of randomness used in security-critical software, not a simple pseudo-random function.
Try it now
Generated entirely in your browser using window.crypto.getRandomValues(). Nothing is transmitted. Passphrases draw from a dictionary of common English words — words are selected at random and no meaning or intent should be inferred from any combination produced.
Technical details
window.crypto.getRandomValues() — cryptographically secure. Not Math.random().3 words = 46.8 bits · 4 words = 62.4 bits · 5 words = 78.1 bits
How to use this tool
- Choose Passphrase (several random dictionary words) or Password (random characters).
- Adjust the options — word count and separator for passphrases; length and character sets for passwords.
- Click Generate, then Copy to copy it to your clipboard.
Passphrase vs password
A passphrase strings together several random dictionary words (e.g. correct-horse-battery-staple style). Because each word is random and unrelated to the others, passphrases are both highly secure and genuinely easier to type and remember than a jumble of symbols. A traditional password packs randomness into fewer, denser characters. Both are strong when generated properly — the right choice usually comes down to where you're typing it and how memorable it needs to be.
Frequently asked questions
What is the difference between a password and a passphrase?
A password is typically a shorter string of random characters (letters, numbers, symbols). A passphrase is a sequence of random words. Both can be made highly secure — a passphrase is often easier to type and remember for a similar or greater level of security.
Is this password generator safe to use?
Yes. It uses your browser's built-in cryptographically secure random number generator (window.crypto.getRandomValues()), the same standard used throughout security-critical software — not a weaker general-purpose random function.
Does Wuluf store generated passwords?
No. Generation happens entirely inside your browser. Nothing is ever transmitted to Wuluf or anyone else — there is no network request involved at any point.
How long should a secure password be?
NIST and NCSC guidance both favour length over complexity. For passwords, 16 characters or more is a sensible default. For passphrases, 4 or more random words comfortably exceeds most modern security standards, including Cyber Essentials.
Should generated passwords be stored in a password manager?
Yes — a reputable password manager is the right place to store unique, randomly generated credentials for every account, so you never need to remember them yourself.
Wuluf's Assessment Services service can help. Audit, gap analysis, and resilience testing against all industry frameworks such as CAF, ISO 27001, NIST, and more.