~ / developer / password-generator

🔐 Password Generator

Builds hard-to-guess passwords with your browser's cryptographic random generator (crypto.getRandomValues). Nothing is sent or saved anywhere.

How to use the password generator

Choose a type. Random characters are best for website logins saved in a password manager; a passphrase is easier for passwords you have to type from memory, like your computer login or your password manager's master password.
Set the length with the slider and pick which character types to include. A new batch is generated every time you change an option.
Click copy next to the one you like, or click the large password at the top to copy the first one. ↻ generate new rolls again with the same settings.

Everything happens inside this browser tab. Passwords are never sent to a server and are not stored in cookies or local storage — the page keeps working even if you go offline after loading it.

How the passwords are generated

Cryptographic randomness. Every character comes from crypto.getRandomValues(), which draws on your operating system's cryptographically secure random number generator (CSPRNG). Unlike Math.random(), earlier outputs can't be used to predict later ones.
No modulo bias. Taking a 32-bit random number modulo the alphabet size (x % n) slightly favors the first characters, because 2³² isn't evenly divisible by n. This tool uses rejection sampling — it discards values from that uneven tail and draws again — so every character is exactly equally likely.
At least one of each type. With this option on, the whole password is regenerated until every selected type appears. Characters are never forced into fixed positions, so no pattern is introduced.

Password strength in bits of entropy

Entropy measures how many guesses an attacker needs, expressed as a power of two. For a random password it's length × log₂(alphabet size). Each extra bit doubles the number of possibilities.

Example

Uppercase 26 + lowercase 26 + digits 10 + symbols 25 = 87 symbols. A 16-character password gives 16 × log₂87 ≈ 16 × 6.44 ≈ 103 bits. Excluding the five look-alikes (0 O 1 l I) leaves 82 symbols and about 102 bits — a 1-bit difference, so turn it on freely. A 6-digit PIN, by contrast, is 6 × 3.32 ≈ 20 bits: only a million possibilities.

Character set (size)	8 chars	12 chars	16 chars	20 chars
Digits only (10)	27 bits	40 bits	53 bits	66 bits
Lowercase only (26)	38 bits	56 bits	75 bits	94 bits
Lowercase + digits (36)	41 bits	62 bits	83 bits	103 bits
Upper + lower + digits (62)	48 bits	71 bits	95 bits	119 bits
Upper + lower + digits + symbols (87)	52 bits	77 bits	103 bits	129 bits

The takeaway: length beats complexity. Sixteen lowercase letters (75 bits) is stronger than eight characters using every type (52 bits). That matches current NIST SP 800-63B guidance, which favors long passwords over forced complexity rules.

Strength levels

Entropy	Label	Average time at 10 billion guesses/sec
under 45 bits	weak	about 30 minutes or less
45–59 bits	fair	about 30 minutes to 1 year
60–79 bits	strong	about 2 years to 1 million years
80 bits and up	very strong	about 1.9 million years or more

"10 billion guesses per second" is a conservative figure for an offline attack on leaked password hashes with modern GPUs. A real login page rate-limits attempts and is far slower — but if a site's database is breached, this speed becomes reality. Treat the times as rough comparisons.

Passphrases (random words)

A passphrase strings random words together, like Maple-Otter-Lunar-Brick7-Kite-Tiger-Cloud — the approach popularized by EFF's Diceware lists and the famous "correct horse battery staple" comic. This tool draws from 512 short, common English words, so each word adds exactly 9 bits (2⁹ = 512). Seven words give 63 bits; adding one digit brings it to about 66. It's longer than a random-character password of the same strength, but much easier to say, remember and type.

The key is that you don't pick the words yourself. "Favorite word + birthday" is easy to guess no matter how many words you use.

Good password habits

A different password for every site. When one site leaks, attackers try the same email and password everywhere else (credential stuffing).
Use a password manager. Nobody can memorize dozens of random passwords. Store them in your browser's built-in manager or a dedicated one (1Password, Bitwarden, etc.) and memorize only a strong master passphrase.
Turn on two-factor authentication. Use an authenticator app or passkey for email, banking and social accounts.
Sites with symbol rules. Some sites allow only certain symbols or cap the length. If a password is rejected, turn off symbols and increase the length instead.

The generator code is embedded in this page and makes no network requests. On a shared computer, remember the copied password may stay on the clipboard — copy something else afterward to overwrite it.

FAQ

Are the passwords generated here stored on a server?

No. They are created in your browser with crypto.getRandomValues and are never transmitted or saved. The page works the same even if you disconnect from the internet after it loads.

How long should a password be?

For randomly generated passwords, use at least 12–16 characters for ordinary sites and 16+ for email, banking and other important accounts. A 16-character mix of upper, lower, digits and symbols is about 103 bits — plenty strong.

Why exclude look-alike characters?

The digit 0 and capital O, and the digit 1, lowercase l and capital I, are hard to tell apart in many fonts, which causes mistakes when you read or retype a password. Excluding them costs only about 1 bit at 16 characters.

What does "bits of entropy" mean?

It is the number of possible passwords expressed as a power of two. 60 bits means 2^60 possibilities, and each additional bit doubles the work for an attacker.

Is a passphrase safer than a random password?

At the same number of bits they are equally strong. Passphrases are longer but far easier to remember and type, which makes them ideal for a master password. The words must be chosen randomly, not by you.

Is it safe to use an online password generator?

It is safe when the generator runs entirely in your browser with a cryptographic random source and sends nothing over the network, as this one does. Avoid generators that create passwords on a server.