Password, passphrase or hex token: which one do you need?

Need a password for an account, words you can type by hand, or a hex key for a config file? FluffyBench's password generator makes all three in your browser. Pick the type the destination asks for, and you're one click from a fresh one.

FluffyBench · 6 min read · Measured October 15, 2026 with generator and rendered-control checks

Which type should I use for an account, a typed secret, or a hex key?

Start with where the secret is going. Most sign-up forms want a password. If you'll have to type it by hand, whole words are easier to get right. And if a config file or developer tool asks for a random key written in hex, that's what Hex token is for.

Here's the choice at a glance, with an example of what each type makes.

Three rows. A website or app asking for a password points to Password, with a 20-character example. Typing it by hand or reading it out points to Passphrase, with six hyphenated example words. A config file asking for a random key in hex points to Hex token, with a 64-character example. — Pick the row that matches where you'll paste the result. How we measured

The place you paste it sets its own rules on length and characters, so check those first. Each type starts at a sensible size, and you can change it within these limits.

Setting	Minimum	Default	Maximum
Password length	8 characters	20 characters	128 characters
Passphrase words	4 words	6 words	12 words
Hex token bytes	8 B	32 B	256 B

Each row shows one type's range and starting size.

Making a password in FluffyBench

Picture a bowl of letter tiles, one for every character the password may use. FluffyBench's password generator draws one tile for each spot in the password, using your browser's built-in cryptographic random source.

Ticking a group under Characters adds its tiles to the bowl. Every spot draws from the whole bowl, so a group you ticked can still be missing from a result.

Lowercase (26), uppercase (26), digits (10) and symbols (23) fill one pool of 85 characters. Each of 20 spots draws from the whole pool; this example result happens to contain no digit. — Drawn with all four groups ticked, the way the page opens.

Here's the whole job, from the settings to copying the result.

Step 1. Password is already selected. Set the length, and tick only the character groups the site allows.
1. Password is selected when the page opens.
2. Type a number, or use − and +, to set the length.
3. Untick any group the site doesn't accept.
Step 2. Press Generate.
1. Generate draws a fresh password with these settings.
Step 3. Your new password appears in the Result panel.
1. The new password. This one is only an example.
Step 4. Check the line under the password.
1. Its length, and a bit estimate explained further down.
Step 5. Press Copy, then paste it into the site or your password manager.
1. Copy puts the result on your clipboard.

Making a passphrase in FluffyBench

A passphrase is the same kind of draw, but each tile is a whole word. FluffyBench picks every word from the EFF long wordlist of 7,776 words, so the result is something you can read aloud and type.

Between words sets the character that joins them. It changes how the phrase looks, not how many choices went into it.

The same six example words joined by a hyphen, a space, an underscore and a period. The note says the words and the 77.5-bit estimate stay the same. — A formatting illustration with example words.

Making one takes three steps.

Step 1. Choose Passphrase, then set the number of words and what goes between them.
1. Choose Passphrase.
2. Set how many words the passphrase gets.
3. Pick the character that joins the words.
Step 2. Press Generate.
1. Generate picks fresh words.
Step 3. Your passphrase appears in the Result panel. Copy it the same way as a password.
1. Six words joined by hyphens.

Making a hex token in FluffyBench

A hex token is random bytes, the basic units computers store data in, written out as plain text you can paste anywhere. It's meant for development keys and IDs, where the program on the other end expects random bytes written this way.

Each byte becomes 2 characters from 0–9 and a–f, so the starting 32 bytes come out as 64 characters.

An example 64-character hex token split into 32 two-character pairs, with one pair marked as one byte. — Hex has 16 symbols, so a pair of them covers all 256 values a byte can hold.

Here's a hex token from start to finish.

Step 1. Choose Hex token, then set Random bytes.
1. Choose Hex token.
2. Set the byte count the program asks for.
Step 2. Press Generate.
1. Generate draws fresh random bytes.
Step 3. Your token appears as one unbroken string. Copy it the same way as a password.
1. 64 hex characters from 32 bytes.

Some programs ask for a UUID instead: a 36-character ID with hyphens in fixed places. That's a different format, and FluffyBench's UUID generator makes it.

Need to generate a UUID?

UUID generator

What does FluffyBench's bit estimate tell me?

The line under every result ends with an estimate in bits, a measure of how many different results the settings could have made. Each extra bit doubles that number.

With the starting settings, a password reports about 128.2 bits and a passphrase about 77.5. Each word you add gives a passphrase almost 13 more.

Bars: hex token, 32 bytes, 256 bits; password, 20 characters, 128.2 bits; passphrase, 6 words, 77.5 bits. Below, 1, 2 and 3 bits give 2, 4 and 8 possible results. — A hex token's 256 bits come from 32 random bytes of 8 bits each.

The estimate describes the generator's settings. It can't tell you whether a site accepts the result or whether an account is safe. For how much is enough, and why a password manager helps, read our guide to password and passphrase strength.

What if a site or FluffyBench says no?

When a site rejects a password, its rules are usually about length or symbols, and you've already met both settings: Length and the Symbols box. If a site wants at least one digit or symbol and your result has none, Generate another under the result gives you a fresh draw.

FluffyBench itself refuses only two things: no character groups at all, and a size outside the range. Here's what each message looks like.

Step 1. With every character group unticked, there's nothing to draw from.
1. All four groups are unticked.
Step 2. FluffyBench asks for at least one group. Tick one and press Generate again.
1. The message says what's missing.
Step 3. A length outside the range printed beside it is refused too.
1. 200 is above the 128-character limit.
Step 4. Change the number to fit the range and press Generate again.
1. The message names the allowed range.

How we measured

Date: October 15, 2026. Runtime: Node.js v24.16.0; browser control values checked in Chrome. Device: Windows 11 Pro; AMD Ryzen 9 5950X.

Password, passphrase, and hex-token defaults; a default-alphabet character-count screen; and rendered inclusive control limits.

500 generated passwords with 128 characters each, a default alphabet of 85 symbols and 84 degrees of freedom; the passphrase uses the bundled EFF long wordlist.

Lengths are characters, words, or bytes as labeled; entropy estimates are bits; the distribution result is a chi-square p-value.

Character-count screen: we tallied how often each of the 85 default characters came up across 500 passwords of 128 characters (64,000 characters in all), and a chi-square test compared the tallies with an even spread. It returned a p-value of 0.054, above the 0.001 cutoff that would flag an imbalance. The screen checks character counts only. It doesn't prove independent picks, entropy, or cryptographic security.

The measured entropy and distribution checks ran with Node Web Crypto; the browser-control check covers visible limits and defaults, not every browser's random source, network traffic, or credential handling after copy.

These checks cover generation mechanics and reported entropy, not whether an output is suitable for a particular service.

The walkthrough screenshots show values generated while they were captured, and the diagrams show example values drawn from the generator's own character groups and the bundled EFF long wordlist. None of them is meant for use.

Password, passphrase and hex token generator