Password Generator
This generator builds random passwords and passphrases inside your browser with cryptographically secure randomness — nothing you see is ever sent over the network or logged. A strong password is at least 16 characters long and mixes upper-case letters, lower-case letters, digits and symbols.
Your password generated in your browser
Excellent · 101 bits of entropy · effectively uncrackable offline
How it works
Every password comes from crypto.getRandomValues(), the browser's cryptographically secure random number generator — the same primitive TLS keys are built on. Two implementation details matter:
- No modulo bias. Naive generators compute
random() % poolSize, which makes some characters slightly more likely. This tool uses rejection sampling: values outside the largest usable multiple of the pool size are discarded, so every character is exactly equally likely. - Every requested character class is guaranteed. One character is drawn from each enabled set, the remainder fills from the combined pool, and a Fisher–Yates shuffle erases the positions — so a 16-character password always contains your chosen mix without predictable placement.
The entropy math behind the strength meter
Entropy in bits equals length × log₂(pool size). The pools used here hold 26 letters per case, 10 digits and 16 symbols:
| Configuration | Pool | Entropy at length 16 |
|---|---|---|
| Lower only | 26 | 75 bits |
| Lower + digits | 36 | 83 bits |
| Mixed case + digits | 62 | 95 bits |
| All classes (default) | 78 | 101 bits |
| Passphrase, 6 words (this wordlist) | 272 per word | 48.5 bits |
| Passphrase, 6 words + two-digit suffix | 272 × 100 | 55.2 bits |
Meter labels follow offline-cracking reality against fast GPU hashes: below 48 bits is Weak (cracked in hours), 48–71 Fair, 72–95 Strong, and 96+ Excellent. Each additional word in a passphrase adds a flat 8 bits because the embedded wordlist holds exactly 272 entries.
Where password generation runs
Most online generators POST your password to a server before showing it to you; it then transits logs, proxies and analytics. Here the entire algorithm ships to you as static JavaScript and executes locally. The server renders only a throwaway example for visitors with JavaScript disabled. After the page loads, generation continues to work with the network disconnected. Your password never exists anywhere but your device.
Pair the result with a password manager, enable two-factor authentication wherever it matters, and never reuse passwords across sites — reuse turns any single breach into a credential-stuffing campaign against every other account with that email.
Related tools
Hardening other parts of your stack? Try the cron expression generator for scheduled jobs, the UUID v4 generator for identifiers and API keys' neighbors, or the Unix timestamp converter when auditing logs. Networking reference work lives in the common ports cheat sheet.
Frequently asked questions
What makes a password strong?
Length first, then unpredictability. A strong password today is at least 16 characters drawn randomly from a large alphabet (upper-case letters, lower-case letters, digits and symbols). Human-invented patterns like Password1! or hunter2 substitutions fail both tests: attackers run dictionaries with mangling rules at billions of guesses per second. Randomness plus length is exactly what the entropy calculation measures.
Is this password generator safe to use?
Yes. Generation runs entirely in your browser using crypto.getRandomValues(), and no password is ever transmitted, logged or stored — the server cannot know what you generated. You can verify this yourself: load the page, disconnect from the network, and keep generating passwords.
How long should my password be?
16 characters with all character classes (~101 bits) is a solid default for anything protected by a rate-limited login form. Use 20+ characters for high-value accounts like email, cloud consoles and password managers. For systems that forbid symbols, compensate with more characters: 20 mixed-case-and-digit characters give ~119 bits.
Are passphrases better than passwords?
They trade raw entropy per character for memorability. Six random words from this site's 272-word list carry about 48.5 bits (55.2 with the two-digit suffix) — enough where a human must remember and type them (disk encryption, master passwords), provided you add more words rather than 'clever' tweaks. For accounts unlocked by a password manager anyway, random characters win because you never have to remember them.
What does 'exclude ambiguous characters' do?
It removes look-alike characters — i, l, 1, L, o, 0 and O — from the pool so nobody can misread a dictated or handwritten password. The cost is small: excluding them shrinks each letter/digit pool slightly and reduces entropy by roughly 4% at the same length, which you can offset by adding one character.
How is password strength calculated here?
The meter reports Shannon entropy: length multiplied by log₂ of the pool size (for passphrases: words times log₂ of the 272-word list, plus 6.64 bits for the optional two-digit suffix). It estimates how hard the search space is for an attacker who knows exactly how the password was built — the correct worst-case assumption.