Passwords are created with your browser's cryptographically secure random number generator and bias-free character selection. Nothing is transmitted, logged, or stored — everything disappears when you leave this page.
- Use a unique password for every account
- Store passwords in a password manager, not a note
- Turn on two-factor authentication where available
How this password generator works
Each character is chosen using the Web Crypto API (crypto.getRandomValues) — the same cryptographically secure random source browsers use for encryption keys — combined with rejection sampling so every character in the selected pool has an exactly equal chance of being picked, with no statistical bias toward any character.
When more than one character type is selected, the generator guarantees at least one character from each enabled type, then fills the rest of the password randomly and shuffles the result — so requirements like "must include a number and a symbol" are met without weakening the overall randomness.
Password length vs. strength
| Length | Approx. entropy | Est. time to crack* |
|---|---|---|
| 8 characters | ~52 bits | ~3 days |
| 10 characters | ~65 bits | ~62 years |
| 12 characters | ~78 bits | ~513,000 years |
| 16 characters | ~104 bits | Effectively uncrackable |
| 20+ characters | 130+ bits | Effectively uncrackable |
*Assuming a full character set (uppercase, lowercase, numbers, symbols) and 10 billion guesses per second — a realistic rate for offline attacks on modern hardware.
Frequently asked questions
Is this password generator secure?
Yes. It uses the Web Crypto API's cryptographically secure random number generator with bias-free character selection via rejection sampling.
Are my generated passwords sent to a server or stored anywhere?
No. Every password is generated locally in your browser. Nothing is transmitted, logged, or saved.
How is password strength (entropy) calculated?
Entropy is the password length multiplied by the base-2 logarithm of the character pool size, giving the number of bits of randomness — more bits means exponentially more combinations to guess.
How long should my password be?
Most current guidance recommends at least 16 characters using a mix of uppercase, lowercase, numbers and symbols.
What are ambiguous characters and why exclude them?
Characters like i, l, 1, L, o, O, 0 and | can look alike in some fonts. Excluding them makes a password easier to read and type correctly, at a small cost to the character pool size.
Should I reuse the same password across different sites?
No. Reusing passwords means a breach on one site can expose your accounts everywhere else — generate a unique password for every account.