Generate strong passwords
Runs locallyCryptographically random passwords, generated in your browser and never transmitted.
Options
Generated
Select at least one character set.
What actually makes a password hard to guess
Strength is a property of how a password was generated, not how it looks. A password picked uniformly at random from a known alphabet has entropy you can calculate: length multiplied by log2(alphabet size). A password a human invented to satisfy a strength meter has far less, because the ways humans substitute characters are few and well known to cracking tools. And storing one needs a slow, salted hash such as Argon2 or bcrypt — not the fast digests in the hash generator.
That is why this generator does two things and no more: it draws from crypto.getRandomValues — the browser's cryptographic random source, not Math.random — and it tells you the resulting entropy in bits, so the number is something you can reason about rather than a coloured bar.
| Password | Entropy | Offline guessing time |
|---|---|---|
| 12 chars, a–z and 0–9 | 62 bits | About a month |
| 12 chars, mixed case + digits | 71 bits | About 50 years |
| 16 chars, mixed case + digits | 95 bits | Hundreds of millions of years |
| 16 chars, + symbols | 105 bits | Beyond any practical attack |
| 20 chars, + symbols | 131 bits | Beyond any practical attack |
| 4-word passphrase (7776-word list) | 52 bits | Under an hour |
| 6-word passphrase (7776-word list) | 78 bits | A few thousand years |
Where people get caught
Math.random() is not for secrets
It is a fast pseudo-random generator seeded from state an attacker can often recover, and a sequence of its outputs can be predicted from earlier ones. Anything that guards an account needs crypto.getRandomValues or a server-side CSPRNG.
Strength meters measure the wrong thing
Tr0ub4dor&3 satisfies every composition rule and is weak, because leetspeak substitution is the first thing a cracking rule set tries. A meter scores the string; only the generation method decides the entropy.
Composition rules shrink the space
"Must contain exactly one symbol, at the end" narrows the keyspace instead of widening it, and pushes people to Password1!. Length with a full alphabet beats any rule about which characters must appear.
Reuse cancels length
A 30-character password used on two sites is one breach away from compromising both. Uniqueness matters more than strength past about 80 bits, which is the argument for a password manager rather than a memorable scheme.
The clipboard remembers
Clipboard managers keep history, and on some systems any application can read the clipboard. Paste it straight into the password manager, then copy something harmless over it.
A four-word passphrase is weaker than it feels
Diceware-style passphrases are excellent for things you must type from memory, but the entropy comes from the word list size and the count, not the length in characters. Four words from a 7776-word list is 52 bits — use six for anything that matters.
About the password generator
How it works in 4 steps · 4 common use cases · 4 questions answered
About the password generator
How it works in 4 steps · 4 common use cases · 4 questions answered
How it works
- 1.Choose a length and which character sets to include — lowercase, uppercase, digits, symbols.
- 2.Optionally exclude look-alike characters such as l, 1, I, O and 0.
- 3.A password is generated from the browser’s cryptographic random source, not Math.random.
- 4.Read the entropy estimate in bits, then copy the password.
Common use cases
- •Creating a service account or database password during setup
- •Generating a shared secret for a webhook signature
- •Producing a password that has to be read aloud or typed by hand, with look-alikes excluded
- •Replacing a password that was committed to a repository by accident
FAQ
Is this random enough to trust?
It uses crypto.getRandomValues, the browser’s cryptographically secure generator, rather than Math.random, whose output is predictable from previous values.
What does the entropy figure mean?
The number of bits of true randomness in the password, given its length and the character sets you enabled. Each extra bit doubles the guessing effort; below about 60 bits a determined offline attack becomes practical.
Is the password sent anywhere?
No. It is generated in your tab and never transmitted or stored. Reloading the page discards it, so copy it before you navigate away.
Is a long passphrase better than a short complex password?
Usually, yes. Length contributes more entropy than symbol variety does, and a long password is easier to type correctly.