Password Generator

How to use this password generator

1. Adjust the length slider and character type checkboxes.
2. A new password generates automatically as you change settings.
3. Click the password to select it, then copy.

Is this secure?

Passwords are generated using your browser's cryptographically secure random number generator (crypto.getRandomValues), and are never sent anywhere — everything happens on your device.

Password entropy — the actual math behind "how strong" a password really is

A password's real strength is precisely measured in bits of entropy, calculated as the length multiplied by the logarithm (base 2) of the character set size used. A 16-character password drawn from a 94-character set (upper and lowercase letters, digits, and common symbols combined) has roughly 105 bits of entropy — meaning an attacker attempting every single possible combination would need to try up to 2^105 possibilities before exhausting the entire space. To put that genuinely astronomical number in perspective, even a determined attacker running a billion guesses per second would still need vastly longer than the current age of the universe to exhaust that search space through brute force alone. This is exactly why entropy, not simply the password's raw length or its apparent visual complexity, is the actual, precise mathematical measure of real password strength.

Why length matters more for entropy than complexity does

Because entropy grows with the character set size raised to the power of length, adding characters to a password increases its strength exponentially, while merely expanding the character set (adding symbols to an already-alphanumeric password, for instance) only increases it linearly by comparison. A 20-character password using only lowercase letters actually has more entropy than a 10-character password using the full mixed set of upper, lower, digits, and symbols combined — length wins out decisively here. This is exactly the mathematical reasoning underlying the modern shift toward long passphrases (several random, unrelated words strung together, an approach popularized by the Diceware method) as a genuinely strong, and often considerably easier to actually remember, alternative to a shorter but more visually complex-looking password packed with symbols.

Why crypto.getRandomValues is fundamentally different from Math.random()

JavaScript actually provides two genuinely different ways to generate random numbers, and the distinction matters enormously specifically for security-sensitive uses like password generation. Math.random() uses a pseudorandom number generator that's optimized purely for speed and statistical distribution quality, not for cryptographic unpredictability — its internal state can, in some implementations, potentially be inferred or reconstructed from observing enough of its output, which would make any password generated from it theoretically predictable to a sufficiently determined, technically sophisticated attacker. crypto.getRandomValues(), which this tool specifically uses, draws instead from the operating system's own cryptographically secure random number source, specifically designed and hardened so that its output is genuinely unpredictable even to someone who has already observed a large amount of its prior output — precisely the property an actually trustworthy password generator absolutely requires.

Why a password's real weak point is often reuse, not the password itself

Even a genuinely strong, high-entropy password generated exactly as this tool does provides real protection only against brute-force guessing attacks specifically — it offers no protection at all against the single most common real-world way passwords actually get compromised: reuse across multiple different sites. If one service you use suffers a data breach and your password leaks in plain text or gets successfully cracked from a leaked hash, attackers routinely and systematically try that exact same leaked password against many other popular sites and services, a widespread, well-documented technique called credential stuffing. This is exactly why using a unique, independently generated password for every single different account — which a password manager makes genuinely practical to actually do at scale — matters just as much for real-world account security as any individual password's own raw mathematical strength.

Limitations of this tool

This tool generates cryptographically random passwords entirely in your browser using crypto.getRandomValues, with nothing ever transmitted anywhere — it doesn't store, sync, or remember any password you generate here, so you'll need your own password manager to actually save and securely retrieve it later. It also can't verify a specific target website's own particular password requirements (some genuinely still restrict maximum length, or oddly disallow certain specific symbols) — if a generated password gets rejected by a particular site, adjusting this tool's character-type settings and regenerating, exactly as the FAQ above suggests, is the straightforward fix.