Password Generator
Create strong, random passwords with cryptographically secure randomness — right in your browser. See entropy and estimated crack time instantly. No app, no signup, nothing stored.
Passwords are created with your browser's cryptographically secure random number generator and bias-free character selection. Nothing is transmitted, logged, or stored — everything disappears when you leave this page.
- Use a unique password for every account
- Store passwords in a password manager, not a note
- Turn on two-factor authentication where available
How this password generator works
Each character is chosen using the Web Crypto API (crypto.getRandomValues) — the same cryptographically secure random source browsers use for encryption keys — combined with rejection sampling so every character in the selected pool has an exactly equal chance of being picked, with no statistical bias toward any character.
When more than one character type is selected, the generator guarantees at least one character from each enabled type, then fills the rest of the password randomly and shuffles the result — so requirements like "must include a number and a symbol" are met without weakening the overall randomness.
Password length vs. strength
| Length | Approx. entropy | Est. time to crack* |
|---|---|---|
| 8 characters | ~52 bits | ~3 days |
| 10 characters | ~65 bits | ~62 years |
| 12 characters | ~78 bits | ~511,000 years |
| 16 characters | ~104 bits | ~35 trillion years |
| 20+ characters | 130+ bits | Over 1,000 trillion years |
*Estimates for the default settings: all four character types (a pool of 91 characters), an attacker who has a stolen list of password hashes and tries 10 billion guesses per second, and an average of half the possibilities tried. They are for comparing lengths, not promises about real attacks.
How to read the entropy and crack-time figures
Entropy is the length multiplied by the base-2 logarithm of the number of characters the generator can choose from. It assumes every position is picked independently and with equal chance, which is how this tool draws characters. Because it also guarantees at least one character of each selected type, the real entropy is slightly lower than the number shown, and the gap is largest for very short passwords.
The crack time assumes an attacker who already has a stolen list of password hashes and can try 10 billion guesses per second, then halves the total because on average half of all possibilities are tried. Real speeds depend on how a website stores passwords, and guesses against a live login page are far slower. Treat the figure as a rough way to compare settings, not as a guarantee.
Using generated passwords safely
- Use a different password for every account, and keep them in a password manager so you do not have to remember them.
- For accounts you care about, longer is better. Current NIST guidance puts length ahead of forced mixes of character types, so 16 or more random characters is a sensible default when the site allows it.
- If a site rejects some symbols or limits the length, switch off a character type or use the exclude box instead of making the password by hand.
- Turn on two-step sign-in where it is offered, and change a password if you learn that a service was breached.
- This page does not save what it generates. Copy a password straight into your password manager or the sign-up form before you leave the page.
Method and sources
Random numbers come from the browser's Web Crypto API (MDN: Crypto.getRandomValues()). If a browser does not provide it, the tool shows a message and does not fall back to a weaker source. Password guidance: NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (final, July 2025).
Frequently asked questions
Is this password generator secure?
Yes. It uses the Web Crypto API's cryptographically secure random number generator with bias-free character selection via rejection sampling.
Are my generated passwords sent to a server or stored anywhere?
No. Every password is generated locally in your browser. Nothing is transmitted, logged, or saved.
How is password strength (entropy) calculated?
Entropy is the password length multiplied by the base-2 logarithm of the character pool size, giving the number of bits of randomness — more bits means exponentially more combinations to guess.
How long should my password be?
Longer is better. Current NIST guidance puts length ahead of forced mixes of character types. For accounts you want to keep secure, 16 or more random characters is a common choice, and a password manager removes the need to remember them.
What are ambiguous characters and why exclude them?
Characters like i, l, 1, L, o, O, 0 and | can look alike in some fonts. Excluding them makes a password easier to read and type correctly, at a small cost to the character pool size.
Should I reuse the same password across different sites?
No. Reusing passwords means a breach on one site can expose your accounts everywhere else — generate a unique password for every account.