---
title: "Secure passwords, instantly. – pwgen.de"
description: "Secure passwords for your sign-ins — generated in your browser, with nothing stored or transmitted."
canonical_url: "https://pwgen.de/en"
meta:
  "og:description": "Secure passwords for your sign-ins — generated in your browser, with nothing stored or transmitted."
  "og:image": "https://pwgen.de/_og/s/o_8801ed3afb2c74c6.png"
  "og:image:height": "630"
  "og:image:type": image/png
  "og:image:width": "1200"
  "og:title": "Secure passwords, instantly. – pwgen.de"
  "twitter:image": "https://pwgen.de/_og/s/o_8801ed3afb2c74c6.png"
---

> Index of every page on this site: [llms.txt](https://pwgen.de/llms.txt)

**Since 2001**

# **Secure passwords, instantly.**

Secure passwords for your sign-ins — generated in your browser, with nothing stored or transmitted.

Length: 16

**A–Z**

**a–z**

**0–9**

**!@#**

**Exclude ambiguous**

Generated locally in your browser: the password never leaves your device. [How to verify this](https://pwgen.de/en/security)

## **Frequently asked questions**

No. The generator runs entirely in your browser and uses your device's Web Crypto API. The result never leaves the page: it is not logged, not stored and not sent to a server. The optional REST API logs no generated values either.

Every character is drawn through crypto.getRandomValues(), the browser's cryptographically secure random source. Selection uses rejection sampling rather than a modulo operation, so every character in the chosen set is exactly equally likely.

With upper and lower case letters, digits and symbols, 16 characters is a good target — a little over 100 bits of entropy. A passphrase reaches a comparable level with five to six random words. Do not go below 12 characters.

Entropy is the base-2 logarithm of how many results were equally likely. Each additional bit doubles the work for an attacker. From around 60 bits, guessing through a login form is hopeless; from 80 bits, so is working through stolen password hashes.

Yes. After a breach, attackers replay the stolen credentials against other services automatically. A unique password per account confines the damage to that single service — a password manager makes this practical.

```json
{"@context":"https://schema.org","@graph":[{"@id":"https://pwgen.de/#website","@type":"WebSite","description":"Kostenloser, datenschutzfreundlicher Passwort-Generator. Generierung direkt im Browser – keine Passwörter werden gespeichert.","inLanguage":"en","name":"pwgen.de","url":"https://pwgen.de/","publisher":{"@id":"https://pwgen.de/#identity"},"translationOfWork":{"@id":"https://pwgen.de/#website"}},{"@id":"https://pwgen.de/en#webpage","description":"Secure passwords for your sign-ins — generated in your browser, with nothing stored or transmitted.","name":"Secure passwords, instantly.","url":"https://pwgen.de/en","@type":["WebPage","FAQPage"],"about":{"@id":"https://pwgen.de/#identity"},"isPartOf":{"@id":"https://pwgen.de/en#website"},"mainEntity":[{"@id":"https://pwgen.de/en#/schema/question/1"},{"@id":"https://pwgen.de/en#/schema/question/2"},{"@id":"https://pwgen.de/en#/schema/question/3"},{"@id":"https://pwgen.de/en#/schema/question/4"},{"@id":"https://pwgen.de/en#/schema/question/5"}],"potentialAction":[{"@type":"ReadAction","target":["https://pwgen.de/en"]}],"primaryImageOfPage":{"@id":"https://pwgen.de/#logo"}},{"@id":"https://pwgen.de/#identity","@type":"Organization","email":"info@htrs.io","legalName":"GbR HTRS i/o","name":"HTRS i/o","telephone":"+49 221 292 513 03","url":"https://pwgen.de","vatID":"DE359532582","address":{"@type":"PostalAddress","streetAddress":"Gotenring 9","addressLocality":"Köln","postalCode":"50679","addressCountry":"DE"},"logo":{"@id":"https://pwgen.de/#logo"},"sameAs":["https://htrs.io"]},{"@id":"https://pwgen.de/en#/schema/software-application/1","@type":"SoftwareApplication","applicationCategory":"SecurityApplication","name":"pwgen.de","operatingSystem":"Web Browser","featureList":["Classic password generator","Diceware passphrase generator","PIN generator","Pronounceable password generator","API token generator"],"offers":{"@type":"Offer","availability":"https://schema.org/InStock","price":"0","priceCurrency":"EUR","priceValidUntil":"2027-12-30T00:00:00.000Z"}},{"@id":"https://pwgen.de/en#/schema/question/1","@type":"Question","inLanguage":"en","name":"Are my passwords stored or transmitted?","acceptedAnswer":{"@type":"Answer","text":"No. The generator runs entirely in your browser and uses your device's Web Crypto API. The result never leaves the page: it is not logged, not stored and not sent to a server. The optional REST API logs no generated values either."}},{"@id":"https://pwgen.de/en#/schema/question/2","@type":"Question","inLanguage":"en","name":"How random are the generated passwords?","acceptedAnswer":{"@type":"Answer","text":"Every character is drawn through crypto.getRandomValues(), the browser's cryptographically secure random source. Selection uses rejection sampling rather than a modulo operation, so every character in the chosen set is exactly equally likely."}},{"@id":"https://pwgen.de/en#/schema/question/3","@type":"Question","inLanguage":"en","name":"How long should a secure password be?","acceptedAnswer":{"@type":"Answer","text":"With upper and lower case letters, digits and symbols, 16 characters is a good target — a little over 100 bits of entropy. A passphrase reaches a comparable level with five to six random words. Do not go below 12 characters."}},{"@id":"https://pwgen.de/en#/schema/question/4","@type":"Question","inLanguage":"en","name":"What does the entropy figure in bits mean?","acceptedAnswer":{"@type":"Answer","text":"Entropy is the base-2 logarithm of how many results were equally likely. Each additional bit doubles the work for an attacker. From around 60 bits, guessing through a login form is hopeless; from 80 bits, so is working through stolen password hashes."}},{"@id":"https://pwgen.de/en#/schema/question/5","@type":"Question","inLanguage":"en","name":"Do I need a separate password for every service?","acceptedAnswer":{"@type":"Answer","text":"Yes. After a breach, attackers replay the stolen credentials against other services automatically. A unique password per account confines the damage to that single service — a password manager makes this practical."}},{"@id":"https://pwgen.de/#logo","@type":"ImageObject","caption":"HTRS i/o","contentUrl":"https://pwgen.de/apple-touch-icon.png","inLanguage":"en","url":"https://pwgen.de/apple-touch-icon.png"}]}
```

## Sitemap

See the full [sitemap](https://pwgen.de/sitemap.md) for all pages.