Password Generator
Cryptographically secure random passwords — no ads, no server.
Why Password Strength Comes Down to Entropy
A password isn't strong because it "looks complicated" to a human — it's strong because of how many guesses a brute-force attacker needs before landing on it by chance. That count is measured in bits of entropy, and every extra bit doubles the guesses required. This generator's two controls, length and character set, exist purely to maximize entropy for whatever length you pick.
How to Use the Generator
- Drag the length slider to at least 16 characters for anything stored in a password manager, or 20+ for a memorized master password.
- Leave all four character-set boxes checked (uppercase, lowercase, numbers, symbols) unless a login form rejects symbols — a few legacy systems still do.
- Click Generate, then Copy — the value goes to your clipboard only, nowhere else.
- Paste it into the site's password field and into your password manager entry. Don't memorize it — that habit is what leads people back to weak, reused passwords.
The Entropy Formula
Entropy (bits) = length × log₂(pool size). "Pool size" is how many distinct characters could appear at each position — checking another character-set box multiplies the combinations at every position, not just adds a few. That's why widening the character set is often more valuable, character for character, than typing extra letters.
| Character set enabled | Pool size | Bits added per character |
|---|---|---|
| Lowercase only (a–z) | 26 | 4.70 |
| + Uppercase (A–Z) | 52 | 5.70 |
| + Numbers (0–9) | 62 | 5.95 |
| + Symbols (!@#$…) | 94 | 6.55 |
Worked Examples
Example 1 — 8 characters, lowercase only. Entropy = 8 × 4.70 ≈ 37.6 bits. Keyspace = 26⁸ ≈ 2.09 × 10¹¹. At 10 billion guesses/second (one GPU against a weakly-hashed leak), that's exhausted in about 21 seconds. Not a safe password today, however "random" it looks.
Example 2 — 12 characters, all four sets enabled. Entropy = 12 × 6.55 ≈ 78.7 bits. Keyspace = 94¹² ≈ 4.76 × 10²³. At 10 billion guesses/second, full exhaustion takes roughly 1.5 million years; even a rented GPU cluster at 1 trillion guesses/second still needs about 15,000 years. A solid baseline for a regular account.
Example 3 — 16 characters, all four sets enabled. Entropy = 16 × 6.55 ≈ 104.9 bits. Keyspace = 94¹⁶ ≈ 3.7 × 10³¹ — on the order of 10¹⁴ years to exhaust at 10 billion guesses/second, roughly 8,500 times the current age of the universe (≈1.38 × 10¹⁰ years). This is the range worth using for anything that gates other accounts, such as an email inbox or a password manager's own master password.
| Attack scenario | Guesses per second | Notes |
|---|---|---|
| Rate-limited login form | ~10 | Site locks or delays after failed attempts |
| Unthrottled login form | ~1,000 | No lockout or CAPTCHA in place |
| Leaked database, slow hash (bcrypt/Argon2) | ~10,000 | Properly salted and stretched |
| Leaked database, fast hash (unsalted MD5/SHA-1) | ~10,000,000,000 | Single consumer GPU |
| Rented GPU cluster / cloud instances | ~1,000,000,000,000 | Well-resourced attacker |
Passphrases vs. Random Strings
A memorable alternative is a passphrase — several unrelated words, in the style of "correct-horse-battery-staple." From a 7,776-word list (the Diceware standard), each word carries log₂(7776) ≈ 12.9 bits, so six random words give about 77.6 bits — comparable to Example 2's 12-character password, but far easier to type by hand. The words must come from an unbiased random draw (dice, or a generator), not be picked by a person; human-chosen "random" words are highly predictable and lose most of that entropy. For a secret you type by hand, a 5–6 word passphrase is a reasonable compromise; for everything else, a fully random string packs more entropy per character.
Common Mistakes
- Reusing a password across sites — one breach exposes it everywhere via automated credential-stuffing attacks.
- Predictable substitutions like "a"→"@" or "e"→"3" — already built into every cracking dictionary, so they add almost no real entropy.
- Trusting length alone. "aaaaaaaaaaaaaaaa" is 16 characters but carries almost no entropy — pool size and unpredictability matter as much as raw length.
- Unchecking symbols "for simplicity" drops about 0.6 bits per character — roughly 10 bits over a 16-character password, meaningfully shortening worst-case cracking time.
What This Tool Does — and Does Not — Do
Generation happens entirely in your browser via the Web Crypto API's crypto.getRandomValues() — cryptographically secure, unlike the predictable Math.random(). Nothing generated here is sent to a server, logged, or stored; refreshing the page clears it. This tool can't stop you from reusing a password elsewhere, remember it for you, or vouch for how a site stores it once submitted — and the crack-time estimates above assume typical hashing speeds, since you can't see what algorithm any given service actually uses. The one thing fully in your control: generate a long, unique, high-entropy password for every account and let a password manager carry the rest.
Sources & further reading
- NIST SP 800-63 Digital Identity Guidelines — federal standards for password length, composition and memorized secrets
- IETF RFC 4086: Randomness Requirements for Security — why cryptographic randomness, not Math.random, must seed secrets
- MDN Web Docs: Crypto.getRandomValues() — the browser API this generator uses for secure random values
Frequently asked questions
Is this password generator secure?
Yes. This random password generator uses crypto.getRandomValues() to produce cryptographically secure random numbers. Unlike Math.random(), the output is unpredictable, and everything runs entirely inside your browser. Generated passwords are never sent to any server.
Are the generated passwords stored anywhere?
No. This tool runs entirely client-side in your browser. Generated passwords are never sent to a server or logged externally, and they disappear from the screen as soon as you refresh the page.
How long should a password be?
At least 12 characters is recommended, and 16 or more for important accounts such as email, banking and work. The longer the password, the exponentially more time a brute-force attack needs — that is the first condition of a strong password.
Why should I include symbols?
Including symbols greatly raises a password's entropy (information content). Lowercase letters alone give 26 possibilities, but combining uppercase, lowercase, numbers and symbols yields about 94 possible characters — dramatically improving brute-force resistance at the same length.
Where should I store the passwords I generate?
Use a password manager such as Bitwarden, 1Password or KeePass. It lets you keep a different strong password for every account without memorizing them, and alerts you to breaches. Avoid saving passwords as plain text in notes or spreadsheets.