Password generator

Click the password to copy it.

Length
Characters
Groups

The separators count towards the length.

Have one already? Check how strong it is

Transparency

Passwords are generated in your browser, by the scripts listed below, and never leave this page.

Enforced by your browser
This page's Content Security Policy allows a single destination, the site's audience measurement (connect-src https://stats.r-no.fr, see below), and forbids any form submission (form-action 'none'), so even a bug could not send a password anywhere but to that server, which belongs to R-no. You can read the policy at the top of the page source.
Audience measurement
Like every page of the site, this one counts its visit with Umami, installed on R-no’s own server (stats.r-no.fr). It receives the address of the page, without parameters or anchor, the site you came from (its domain only), your browser, system, language and screen size, and the country, region and city deduced from your IP address, which is not kept. It never receives what you type, nor the result of the tool. No cookie, nothing stored in your browser; if your browser asks not to be tracked (Do Not Track), nothing is measured. The data is erased after 25 months.
  • /commun/mesure.js: the filter applied before each sending, written for R-no Toolbox. 1.4 kB
    SHA-256 225eec74fd12623d82fc05ee7d222be629ce454d081c129e8d1e249ed37ee716
  • https://stats.r-no.fr/m.js: Umami’s tracker, open source (MIT), served by the measurement server. Its fingerprint is not shown here: it changes with each version of Umami, and you cannot check from your browser that it is the published code. For that part, you have to trust R-no.
What is stored
No cookie, and nothing in the address. Passwords are never stored. Your language is given by the address itself (/en/ or /fr/): nothing is stored to remember it. Like any website, the server records the download of the page and its files in its access logs (IP address, date and time, address requested, browser name). It never receives a password.
Code that runs here
  • app.js: the password generator, written for R-no Toolbox. Not minified, no third-party library. 9.3 kB
    SHA-256 4fef0c44b805e8b0da766b3b8f8b2a5e45512c82f5cb9c4ff09844792f8ad829
  • textes.js: the French messages of the tool, shown by its script (the rest of the French page is written into its HTML when the site is built). It only defines texts, with no logic. 4.5 kB
    SHA-256 56a54e5681e353701c617de97e8afcb28ac8c8942bb71ce707f825c42dc7c9ca
  • /commun/langue.js: the language helper, the same on every page of the site. It reads the language of the page and gives the tool its messages in that language. It stores nothing. 1.6 kB
    SHA-256 80f76f69773ef628d36d09bf8387cfedebda4529210d7120649b6f5603310631
Where the randomness comes from
Your browser's cryptographic random generator, crypto.getRandomValues (Web Crypto API). Draws that would favour some characters are rejected rather than folded with a modulo, so every character of the chosen set is equally likely. At least one character of each selected type is included, then the order is shuffled.
Check it yourself
Download a script and compare its fingerprint with the one above:
curl -s https://r-no.fr/passwords/generator/app.js | shasum -a 256
Limits
The strength shown is a simple calculation: the number of possible passwords with these settings, in bits. It is slightly optimistic, because each selected character type is forced to appear. For an analysis that also looks for words and patterns, use the strength checker.