Password Generator

Generate strong, random passwords with control over length, symbols, numbers and case. Runs entirely in your browser — nothing is sent anywhere.

Everything happens in your browser. The password is never sent over the network, saved, or logged — reload the page and it is gone.

Your password

Select at least one character type to generate a password.

Estimated strength

of entropy from a -character alphabet.

Your browser does not expose window.crypto.getRandomValues, so this fell back to Math.random — fine for throwaway logins, not for anything valuable.

What this password generator does

This tool builds a random password from the character types you choose — uppercase letters, lowercase letters, digits and symbols — at any length from 4 to 64 characters. Randomness comes from window.crypto.getRandomValues, the browser's cryptographically secure random number generator, which is the same primitive password managers and TLS libraries use. If a very old browser doesn't provide it, the tool falls back to Math.random and tells you on screen that it did, because Math.random is not designed to be unpredictable and shouldn't be trusted for anything that matters.

Nothing leaves your browser. The page is static, there is no server call, no analytics event and no storage — the password exists only in the tab you're looking at, and disappears when you close or reload it. You can verify that by opening your browser's network tab while you click Regenerate, or by reading the page source.

How to use it

  1. Drag the length slider. Longer beats clever: every extra character multiplies the search space.
  2. Tick the character types you want. Some sites reject certain symbols, so you can turn symbols off if a form refuses your password.
  3. Turn on Avoid look-alike characters if you'll be reading the password off a screen and typing it on another device — it removes I, l, 1, O, 0 and o, which are easy to confuse in many fonts.
  4. Click Copy, paste it into the site, and store it in a password manager. A generated password you can't remember is only useful if something remembers it for you.

How the strength number is calculated

For a password picked uniformly at random, strength is measured in bits of entropy:

entropy = L × log2(N)

  • L = password length in characters
  • N = size of the alphabet you selected

Each bit doubles the number of guesses an attacker needs. The labels this tool shows follow a common rule of thumb — under 40 bits is weak, 40–59 fair, 60–79 strong, 80+ very strong — and they only hold because the password is machine-generated. Entropy says nothing about a password a human invented: P@ssw0rd! has the same length and alphabet as a random nine-character string but is one of the first things any cracking tool tries.

One caveat the tool is honest about: forcing at least one character from every selected type slightly reduces the true entropy compared with the formula above, because it rules out some otherwise-valid passwords. The effect is a fraction of a bit at normal lengths, so the estimate stays a fair upper bound — but it is an upper bound, not an exact figure.

A worked example

Suppose you choose 16 characters with uppercase, lowercase and digits enabled and symbols off. The alphabet is 26 + 26 + 10 = 62 characters, so entropy is 16 × log2(62) ≈ 16 × 5.95 ≈ 95 bits. That is roughly 4 × 1028 possible passwords.

To turn bits into time, divide by whatever guess rate you think an attacker can achieve — that rate depends entirely on how the site stored your password, so pick it yourself rather than trusting a single scary number. If you assume an offline attack against a fast hash at one trillion (1012) guesses per second, 4 × 1028 candidates take on the order of 1016 seconds to exhaust. Against a properly configured slow hash such as bcrypt, argon2 or scrypt, the same attacker manages a tiny fraction of that rate. Against an online login form with rate limiting, it's a few guesses per second at best.

Drop to 8 characters with the same alphabet and entropy falls to about 48 bits — around 2 × 1014 candidates, which the same trillion-guess-per-second assumption chews through in minutes. That gap is why length is the setting worth moving first.

Practical advice

  • Never reuse a password. Credential-stuffing attacks work by replaying passwords leaked from one breached site against every other site. Uniqueness matters more than complexity.
  • Use a password manager. It is the only realistic way to keep dozens of unique random passwords.
  • Turn on two-factor authentication where it's offered. It protects you even if the password is exposed.
  • For passwords you must type from memory — a device unlock code, your password manager's master password — a random multi-word passphrase is usually easier to remember at equal entropy than a random character string.
  • Don't rotate passwords on a schedule without a reason. Modern guidance from NIST recommends changing a password when there's evidence of compromise, not every 90 days, because forced rotation pushes people toward predictable variations.

References

✏️ Edit this page on GitHub