Password generator

Click the password to copy it.

Length
Characters
Groups

The separators count towards the length.

Have one already? Check how strong it is

Transparency

Passwords are generated in your browser, by the scripts listed below, and never leave this page.

Enforced by your browser
This page's Content Security Policy forbids any network request and any form submission (connect-src 'none'; form-action 'none'), so even a bug could not send a password anywhere. You can read the policy at the top of the page source.
What is stored
No cookie, and nothing in the address. Passwords are never stored. Only your language choice, if you make one, is kept in this tab's sessionStorage until you close it. Like any website, the server records the download of the page and its files in its access logs (IP address, date and time, address requested, browser name). It never receives a password.
Code that runs here
  • app.js: the password generator, written for R-no Toolbox. Not minified, no third-party library. 9.2 kB
    SHA-256 63ce1f6b5d16df6f2fcac1bb152fc809023d0f6093f85a1fb45321dbb7e04118
  • textes.js: the French text of this page. It only defines texts, with no logic. 4.3 kB
    SHA-256 eff8ee56aa73751e09311e8ded90127e808962f87a05ffa3e61e9bcf5b92a592
  • /commun/langue.js: the language switcher, the same on every page of the site. It reads and writes only the language choice. 5.7 kB
    SHA-256 a41e6774538ae00aa6535d4ac2e7b482dd9134c7dcd2e0d9a1bf41b35b673ae7
Where the randomness comes from
Your browser's cryptographic random generator, crypto.getRandomValues (Web Crypto API). Draws that would favour some characters are rejected rather than folded with a modulo, so every character of the chosen set is equally likely. At least one character of each selected type is included, then the order is shuffled.
Check it yourself
Download a script and compare its fingerprint with the one above:
curl -s https://r-no.fr/passwords/generator/app.js | shasum -a 256
Limits
The strength shown is a simple calculation: the number of possible passwords with these settings, in bits. It is slightly optimistic, because each selected character type is forced to appear. For an analysis that also looks for words and patterns, use the strength checker.
Source repository
The R-no Toolbox repository is private. The files listed above are the complete tool, exactly as your browser runs it.