Strong Password Generator — Offline, No Upload

🔒 Generated in your browser with Web Crypto · Never sent or stored · Never written to the URL · Works offline · Free, no sign-up

How to generate a strong password

Pick a mode

Random password for password managers, or a word passphrase you can type and remember.

Set the rules

Length, character sets, ambiguous-character filter, or the number of words and separator.

Check the strength

See entropy in bits and an estimated offline crack time, calculated on your device.

Copy or download

Copy one, or generate up to 50 at once and save them as a .txt file. Nothing is uploaded.

A password generator that never sees your passwords

Passly runs entirely in your browser. Every character comes from crypto.getRandomValues, the same cryptographically secure generator browsers use for encryption keys, with rejection sampling so no character is more likely than another. Passphrases pick words from the EFF Large Wordlist that ships with the page. Nothing is sent to a server, nothing is logged, and passwords are never placed in the URL, so even your browser history stays clean.

Features

Random passwords from 4 to 128 characters with any mix of character types
Passphrases of 3–12 words with your choice of separator, capitals and a number
Live entropy in bits plus an estimated offline crack time
Generate up to 50 at once, copy all, or download a .txt file

Why Passly?

🚫 Generated on your device: passwords are never sent, logged or stored
🎲 Secure randomness only (Web Crypto, no Math.random, no modulo bias)
🛡️ Never written to the URL, so copied links and history cannot leak a password
🆓 Free, no sign-up, no limits, works offline after the page loads

All ToolBookly tools · Diffly · JSONly · Jwtly · BaselY · QRly

Frequently Asked Questions

Are the passwords sent or stored anywhere?

No. Passly generates every password and passphrase inside your browser with the Web Crypto API. Nothing is sent to ToolBookly, nothing is logged, and nothing is saved on a server. Once the page has loaded it even works offline.

How random are the passwords?

Passly uses crypto.getRandomValues, the browser’s cryptographically secure random generator, and rejection sampling so every character is equally likely (no modulo bias). It never uses Math.random.

Password or passphrase — which should I use?

Use a random password for anything stored in a password manager. Use a passphrase (several random words) for things you must type or remember, such as a master password or device login. A 6-word passphrase from the EFF list gives about 77 bits of entropy.

What do the entropy and crack-time numbers mean?

Entropy (bits) measures how many guesses a random password needs on average. The crack-time estimate assumes an offline attacker making 10 billion guesses per second against a fast hash. It is a rough guide, not a guarantee; real attacks and hash settings vary.

Why is there no share link?

A password should never travel in a URL. Passly deliberately never writes generated passwords or your settings into the page address, so links you copy cannot leak a secret.

Where does the passphrase word list come from?

Passly uses the EFF Large Wordlist (7,776 words) by the Electronic Frontier Foundation, licensed CC BY 3.0 US. The whole list ships with the page, so picking words never needs a server.

I also need to format JSON that contains API keys — is that safe here?

Passly never sees your passwords, and for JSON with secrets use JSONly — ToolBookly's browser-side JSON formatter and validator. It beautifies and validates locally with no upload, the same no-middleman model as Passly. Open JSONly — private JSON formatter ↗

Is Passly free?

Yes. Free, no sign-up, no limits. It is part of the ToolBookly suite of browser tools.