Password Generator
Create strong, unpredictable passwords with custom length and character sets. Generated locally in your browser using the Web Crypto API.
Click Generate below to create a secure password.
Character rules
crypto.getRandomValues). Passwords are never sent over the network.Introduction
Weak and reused passwords are the leading cause of account compromises. A strong password must be long, unpredictable, and unique to each service you use. This password generator creates high-entropy passwords entirely on your device using your browser's native cryptographic random number generator.
How to use this password generator
- Choose length: Adjust the slider or type a length between 8 and 128 characters. 16 or more characters is recommended for general online accounts.
- Select character rules: Toggle uppercase letters (A–Z), lowercase letters (a–z), numbers (0–9), and symbols (!@#$%).
- Generate & copy: Click Generate password or Generate again, then copy the result with one click.
Why Web Crypto instead of Math.random()?
Standard JavaScript Math.random() is a pseudo-random number generator (PRNG) designed for speed, not security. Its internal state can be determined after observing a small sequence of outputs, making it unsuitable for generating credentials.
This tool exclusively uses the W3C crypto.getRandomValues() API, which draws entropy from your operating system's cryptographic random pool (such as /dev/urandom on Unix or CryptGenRandom on Windows). Character selection also employs rejection sampling to eliminate modulo bias, ensuring every character in the chosen set has an equal probability of appearing.
Password Strength & Estimated Crack Time
Understanding entropy helps demonstrate why length is exponentially more protective than complexity alone. Below is an estimated benchmark based on modern high-speed offline GPU brute-force clusters:
| Password Length | Character Types | Entropy (Bits) | Estimated Brute-Force Time |
|---|---|---|---|
| 8 characters | Numbers only | ~27 bits | Instantly (< 1 second) |
| 8 characters | Lowercase letters | ~38 bits | Minutes |
| 10 characters | Letters + Numbers | ~60 bits | Several weeks |
| 12 characters | All character sets | ~79 bits | ~3,000 years |
| 16+ characters | All character sets | ~105+ bits | Trillions of years (Virtually uncrackable) |
Password security best practices
- Prioritize length: A 16-character password with letters and numbers has vastly higher entropy than an 8-character password with complex symbols.
- Never reuse passwords: If one website suffers a data breach, credential stuffing attacks will attempt to use that same combination across other platforms.
- Use a password manager: Password managers securely store and autofill complex, unique passwords so you only need to remember one master passphrase.
- Enable Multi-Factor Authentication (MFA): Whenever available, enable two-factor or multi-factor authentication (such as authenticator apps or hardware keys) for critical accounts.
Frequently Asked Questions
Are generated passwords sent to or stored on any server?
No. All password generation happens 100% locally inside your browser via the Web Crypto API. No network requests are made, and zero passwords are saved or tracked.
How long should a strong password be?
Security standards recommend a minimum of 16 characters for general online accounts, and 20+ characters for high-risk accounts like primary email, banking, and password manager master keys.
Why does this generator use Web Crypto instead of Math.random()?
Standard JavaScript Math.random() is a pseudo-random generator whose internal seed is predictable. The Web Crypto API (crypto.getRandomValues()) draws true cryptographic entropy from your operating system kernel.
What is password entropy and how is it measured?
Password entropy is measured in bits (E = L × log2(R)). A 16-character password with letters, numbers, and symbols delivers ~95 bits of entropy, which would take billions of years for modern supercomputers to brute-force.
Why do some services restrict specific symbols?
Legacy backend databases sometimes fail to sanitize characters like quotes or backslashes properly. Our tool lets you toggle symbols on and off to meet strict site requirements.
Should I memorize my generated passwords?
No. You should use an encrypted password manager (like Bitwarden, 1Password, or Keychain) to store unique credentials, and only memorize one master passphrase.