Choosing Between Passwords and Passphrases
Selecting the correct credential type depends on how you intend to use and store it.
A random password consists of a dense string of letters, numbers, and symbols. Because it packs high entropy into a short string, it is the optimal choice when you store and autofill credentials using a password manager.
A passphrase consists of multiple real words strung together. This format is easier to memorize, read aloud, or type manually. Passphrases are ideal for credentials you must enter by hand, such as device unlock codes, Wi-Fi network keys, or the master password for your password manager.
Using unique, strong credentials across different online services and devices prevents a single compromised account from exposing your entire digital footprint.
Password Customization and Generation Rules
When generating a password, the tool allows you to adjust the length from a minimum of 4 to a maximum of 64 characters, with a default length of 16. You can customize the character pool using four checkboxes:
- Uppercase (A-Z) (selected by default)
- Lowercase (a-z) (selected by default)
- Numbers (0-9) (selected by default)
- Symbols (!@#$…) (selected by default)
To prevent visual confusion when reading or typing the password, you can select Exclude ambiguous characters (0, O, I, l, 1).
Character Distribution Rules
When multiple character types are selected, the generation logic ensures that at least one character from each selected type is included in the final password, provided the chosen length is sufficient. The remaining positions are filled by sampling from the combined set of all selected character types.
If you deselect all four character checkboxes, the tool cannot generate a password. It will display the error message:
Select at least one character type.
When this error occurs, the generated result, entropy value, and strength indicator are cleared.
Passphrase Customization and Wordlist Loading
Passphrases are constructed using a wordlist containing 7,776 distinct words. You can customize the passphrase using the following parameters:
- Word count: A value from 3 to 10 words, with a default of 6.
- Separator: The character placed between words. Options include Hyphen, Space, Period, or None.
- Capitalize words: A checkbox to capitalize the first letter of each word.
- Include a number: A checkbox to add a digit to the passphrase.
Loading States
Because the passphrase generator relies on an external list of words, the tool displays the status message Loading word list… while fetching the list. If the list fails to load, the interface displays:
The word list could not be loaded. Check your connection and try again.
Understanding Entropy and Strength Indicators
The tool displays an entropy value and a qualitative strength rating to help you evaluate the security of your generated credential.
Entropy Calculation
Entropy measures the raw randomness of the generated credential in bits. A higher entropy value indicates that the credential is more resistant to brute-force attacks. The calculation assumes that an attacker knows the exact generation method, meaning it measures mathematical randomness rather than providing a crack-time estimate against pattern-based or dictionary attacks.
- For Passwords: Entropy is calculated as: Length × log₂(Size of active character pool) The pool size depends on which character sets are selected and whether ambiguous characters are excluded.
- For Passphrases: Entropy is calculated as: Word count × log₂(7,776) Each word selected from the 7,776-word list contributes approximately 12.92 bits of entropy.
Strength Ratings
Based on the calculated entropy, the tool assigns one of four strength levels:
- Weak
- Fair
- Strong
- Very strong
Local Browser Processing and Privacy
This tool runs entirely in your web browser. All password and passphrase generation is performed locally on your device using your browser's built-in, cryptographically strong random number generator.
No data, credentials, or configuration settings are sent to BroBroGo, uploaded, or stored externally.
Frequently Asked Questions
How is the randomness generated?
Every character and every word is picked with cryptographically strong browser randomness, not a predictable random source. Each pick uses rejection sampling so no character or word is ever favored over another.
Should I use a password or a passphrase?
Whichever one you will actually have to type. If a password manager stores and fills it, use a password; if it has to come out of your own memory or off a screen, use a passphrase.
What does the entropy number mean?
How many bits of randomness the value carries, on the assumption that an attacker already knows exactly how it was generated. It is a measure of raw randomness, not a crack-time estimate against dictionary or pattern attacks.