A password generator produces random passwords that no person would think of and no dictionary contains. This one uses your browser's cryptographic random number generator, shows how much entropy each password actually carries, and never transmits or stores what it creates.
Choosing a good password
Length matters far more than complexity. A long password from a smaller alphabet beats a short one full of symbols.
- Use at least 16 characters for accounts that matter.
- Use a unique password for every service, so one breach cannot cascade.
- Store them in a password manager rather than trying to memorise them.
- Turn on two-factor authentication wherever it is offered.
What entropy means
Entropy measures how many guesses an attacker would need, expressed in bits. Each extra bit doubles that number. It is calculated as the password length multiplied by the base-2 logarithm of the alphabet size.
Below about 60 bits a password is within reach of a determined offline attack against a leaked hash. Around 80 bits is comfortable for most accounts, and beyond 112 bits the password is no longer the weak link in any realistic scenario.
Why randomness quality matters
Passwords here come from crypto.getRandomValues, the browser's cryptographically secure generator, rather than Math.random, whose output is predictable to anyone who can observe enough of it.
Characters are also drawn using rejection sampling rather than a simple modulo operation. Modulo introduces a small bias towards the start of the alphabet, which measurably reduces real-world strength — a subtle flaw present in a surprising number of password tools.
FAQ
Are the generated passwords stored anywhere?
No. Generation happens entirely in your browser. Nothing is sent over the network, written to a server, or kept after you close the page. Reloading discards everything.
How long should my password be?
Sixteen characters from a mixed alphabet is a sensible default and gives roughly 100 bits of entropy. For a password manager master password or an encryption key, prefer 20 or more.
Should I exclude look-alike characters?
Only when a human will read or retype the password — for example a Wi-Fi key read aloud, or credentials printed on paper. Excluding them shrinks the alphabet slightly, which lowers entropy, so leave them in for anything stored in a password manager.
Are symbols required for a strong password?
No. Adding four more characters increases strength more than adding symbols to a short password. Some systems still reject certain symbols, so a long alphanumeric password is often the more practical choice.