Password generator

Each character is picked at random from the sets you turn on, using your browser's cryptographic random number generator (crypto.getRandomValues), never Math.random. The picks are unbiased, so every character in the pool is equally likely. If a set you chose is missing, the whole password is drawn again, so you always get at least one of each.

For most accounts, 16 characters with all four character sets is a good default: about 103 bits, far beyond what an offline attack can search. 12 characters gives about 77 bits, which is still strong. Go shorter only when a site forces you to, and use a longer password for anything important.

A passphrase is a few random words, like cactus-velvet-harbor-pebble-lantern. Each word from the 7,776-word list adds about 12.9 bits, so 5 words give about 65 bits and 6 words about 78 bits, as much as 12 random characters. The words must be picked at random, as they are here; a phrase you think up yourself is much easier to guess.

Diceware is a way to make a passphrase by rolling five dice for each word and looking the result up in a list of 7,776 words, one for every possible roll. This tool uses the Electronic Frontier Foundation's large word list, made for exactly that, and does the rolls with your browser's cryptographic random number generator.

From how the password was made, not from how it looks. Entropy counts the equally likely passwords the generator could have made, in bits: about length × log2(pool size) for a random password and words × log2(7,776) for a passphrase. The time to guess assumes an offline attack trying 10 billion guesses a second, which on average finds the password halfway through.

No. Passwords are made in your browser and never sent to Trezio or anyone else, and they are not saved in this browser either, so a refresh makes them gone for good. Only your options, like the length and the character sets, are kept in this browser's local storage so the page opens the way you left it. A copied password stays on your clipboard until you copy something else.

Somewhere encrypted, not in a plain note. Trezio's browser extension and Android app can save a login with a screenshot of its sign-in page, encrypted on your device with AES-256-GCM before it is uploaded, and your master password never leaves your device. There's a free plan.