What is the Password Generator?
This tool creates random passwords in your browser using the operating system's cryptographic random number generator. You control the length and which character classes are included, and nothing is transmitted or stored.
A password's resistance to guessing is measured in entropy, the number of bits of randomness it contains. Entropy depends on two things: the size of the alphabet each character is drawn from, and the number of characters. A 16-character password drawn from a 94-character alphabet carries roughly 104 bits, which is far beyond brute-force reach.
What matters just as much is the source of randomness. This tool uses the Web Crypto API's getRandomValues, which draws from the operating system's cryptographically secure entropy pool. That is a meaningfully different guarantee from Math.random, which is fast but predictable and unsuitable for anything security-related.
The most consequential property of a password, though, is not its complexity but its uniqueness. A reused password is only as safe as the least careful site that stores it, which is why credential-stuffing attacks work so well.
How to use the Password Generator
- Choose a length. Sixteen characters or more is a sensible default for accounts that matter. Longer is straightforwardly better when a password manager is doing the remembering.
- Select character classes. Enable lowercase, uppercase, digits, and symbols. Each class you add widens the alphabet and increases entropy per character.
- Generate. A new password is produced immediately. Generate repeatedly until you get one you are happy to work with, if you need to type it by hand.
- Copy it into your password manager. Save it before navigating away, the password is not stored anywhere and cannot be recovered once the page is closed.
Worked examples
How length and alphabet affect entropy
Entropy is log2(alphabet size) multiplied by length. Adding characters raises it faster than adding character classes.
8 chars, lowercase only (26) -> ~37.6 bits
8 chars, all classes (94) -> ~52.4 bits
16 chars, all classes (94) -> ~104.9 bits
24 chars, all classes (94) -> ~157.3 bitsDoubling the length doubles the entropy.
Adding symbols to a short password helps far less
than simply making it longer.Common use cases
- Creating unique credentials per site. Generating a fresh password for every account is what limits the damage from any single breach.
- Rotating a credential after an incident. When a service discloses a breach, replacing the password with a newly generated one is the immediate remedy.
- Producing API keys and service secrets. A long random string is appropriate for machine-to-machine credentials where nobody needs to type or remember it.
- Setting up database and admin accounts. Default and human-chosen credentials on infrastructure are a recurring source of compromise.
Features and limitations
- Uses crypto.getRandomValues, the browser's cryptographically secure random source, not Math.random.
- Configurable length and character classes.
- Generates entirely client-side, with no network request at any point.
- Nothing is logged, stored, or written to browser storage, closing the tab discards the password permanently.
- Some sites impose maximum lengths or forbid certain symbols; you may need to adjust the character classes to satisfy such rules.
Frequently asked questions
Are these passwords actually random?
They are drawn from crypto.getRandomValues, which is backed by the operating system's cryptographic entropy pool. This is the same class of randomness used for generating encryption keys, and is not predictable from previous outputs.
Is the generated password sent anywhere?
No. Generation happens entirely in your browser with no network request. Nothing is stored either, so you must copy the password before closing the page.
How long should a password be?
Sixteen characters with mixed classes is a good general baseline, and twenty or more for high-value accounts such as email or banking. Since a password manager does the remembering, there is little reason to go short.
Do symbols matter more than length?
Length matters more. Each additional character multiplies the search space, whereas adding a character class only widens the per-character alphabet. A long password from a smaller alphabet beats a short one with every symbol.
Should I reuse a strong password across sites?
No. Reuse is the single biggest practical risk, because a breach at any one site exposes every account sharing that password. Attackers routinely replay leaked credentials across other services.
Are passphrases better than random passwords?
A long passphrase of several genuinely random words can reach comparable entropy and is far easier to type from memory. It is a good choice for the handful of passwords you must actually remember, such as your password manager's master password.
All processing happens locally in your browser, your data never leaves your device.