Password Generator
Weak passwords are still how most accounts fall — not through Hollywood hacking, but credential stuffing with passwords leaked from other breaches. This free password generator creates cryptographically random passwords with an honest entropy readout, so you can see the math instead of trusting a vague "strength meter". It uses your browser's Web Crypto API (crypto.getRandomValues) and runs 100% client-side: generated passwords never leave your device.
100% client-side — nothing is stored or transmitted.
What makes a password strong
Strength is math, not mystery. A password's entropy — its unpredictability in bits — is length × log2(character-set size). A 16-character password from 86 possible characters carries ~103 bits, meaning an attacker needs ~2103 guesses on average. That's why length beats cleverness: P@ssw0rd! looks complex but appears in every breach dictionary, while a boring 20-character random string has never been seen by anyone. The entropy readout above does this arithmetic for you — aim for 80+ bits for anything that matters.
Common use cases
- New account signups — generate a unique 16–20 character password per site.
- Wi-Fi passwords — long random strings you type rarely but share occasionally.
- API keys and tokens — high-entropy secrets for development and services.
- Password resets — replace a breached or reused password with a fresh random one.
- Bulk credential setup — generate-then-store in a password manager during onboarding.
How to use it
- Set the length (16 is a solid default; 20+ for high-value accounts).
- Choose character sets; enable "exclude ambiguous" if you'll transcribe it by hand.
- Click Generate, check the entropy readout, then Copy.
- Paste it into your password manager — never reuse it anywhere else.
How to read the entropy number
The tool shows two numbers: entropy in bits and an estimated brute-force time. The time estimate assumes an attacker guessing 10 billion passwords per second — realistic for a fast offline attack against a weak hash, pessimistic (in your favor) against slow hashes like bcrypt. The honest reading: anything above ~80 bits is beyond brute force for any plausible adversary; below ~60 bits, you're relying on the site's rate limiting and breach luck. Note what the estimate doesn't cover: phishing, keyloggers, and password reuse defeat entropy entirely — which is why uniqueness per site matters more than squeezing out extra bits.
Passwords vs passphrases
There's exactly one password you should memorize: your password manager's master password. For that, a passphrase of 5–7 random words wins — "correct horse battery staple" style — because humans remember words far better than character soup, and 5 random words from a 7,776-word list carry ~64 bits of entropy. For every other credential, memorability is irrelevant: let the manager hold a 20-character random string. The worst pattern is a "clever" human password used everywhere; the second worst is a strong password reused in two places.
What not to do
- Don't reuse passwords. Breaches are public; credential stuffing is automated. One leak compromises every site sharing the password.
- Don't trust "clever" substitutions.
P@ssw0rdis in every attack dictionary within the first thousand guesses. - Don't store passwords in notes, spreadsheets, or chat. Use a dedicated manager with a strong master passphrase.
- Don't rely on SMS 2FA alone. It's better than nothing, but SIM-swap attacks are real; authenticator apps or passkeys are stronger.
- Don't email passwords to yourself (or anyone). Email is not a vault.
Limitations
A generator solves exactly one problem: unpredictability. It can't fix reuse, phishing, malware, or a breached service storing passwords in plaintext. Treat generated passwords as one layer: unique per site, stored in a manager, backed by two-factor authentication on important accounts. And if a site caps passwords at 12 characters or bans pasting — complain to them, then comply as best you can; those are anti-patterns, but your account still needs a password.
Frequently asked questions
- Is it safe to use an online password generator?
- It depends on the generator. This one runs entirely in your browser using the Web Crypto API's random number generator — the same cryptographic randomness operating systems use for keys. Nothing is sent to any server, nothing is logged, and nothing is stored. A generator that "checks" your password by sending it somewhere is the kind to avoid.
- How long should my password be?
- Sixteen characters from a mixed character set gives about 103 bits of entropy — far beyond brute-force reach for any realistic attacker. For high-value accounts, 20+ characters is comfortable overkill. Length matters more than complexity: a 20-character lowercase password is stronger than an 8-character "complex" one.
- What is password entropy?
- Entropy measures unpredictability in bits: bits = length × log2(character-set size). Each extra bit doubles the guesses an attacker needs. The tool shows this number honestly — compare it against the ~80-bit threshold that NIST-style guidance treats as effectively unbreakable by brute force.
- Are passphrases better than random passwords?
- For passwords you must memorize, yes: five random words ("correct horse battery staple") are easier to remember and carry similar entropy to a shorter random string. For everything else — which should be nearly everything — a password manager holding long random passwords is the better answer.
- Can this tool remember my passwords?
- No, and that's by design. The generated password exists only in this page until you copy it. Store it in a reputable password manager (Bitwarden, 1Password, KeePass) — never in a notes app, spreadsheet, or chat message.
- Why exclude similar characters?
- Characters like I, l, 1, O, and 0 look identical in many fonts. Excluding them avoids transcription errors when you read a password off one screen and type it into another. It costs a tiny amount of entropy per character — length compensates trivially.
- Do I need symbols in every password?
- Not strictly — they add entropy, but adding 2–3 more characters adds more. Symbols mainly help satisfy sites with complexity rules. If a site rejects long passwords but demands symbols, that's a sign of outdated password policy, not better security.