Password Generator
Strong passwords from your browser’s cryptographic random source — never sent anywhere.
Start typing above and the result appears here.
How to use Password Generator
Set the length
Twenty characters is a good default for anything stored in a password manager. Length matters far more than which symbols you include.
Generate
Press Generate for a fresh batch. Nothing is stored, logged or transmitted.
Save it in a password manager
A generated password is only useful if you never have to remember it. Copy it straight into a manager.
Why use this password generator
Runs on your device
Your input is handled entirely in this browser tab. Nothing is uploaded, so there is nothing for us to store, log or leak.
No sign-up, no quota
No account, no daily limit, no watermark and no email wall. Use it once or two hundred times a day.
Built to be linked
Options are stored in the URL, so a configured tool is a link you can send to a colleague or bookmark.
Technical notes
Two implementation details separate a real password generator from a demo. First, crypto.getRandomValues rather than Math.random, whose state is recoverable from a handful of outputs. Second, rejection sampling instead of a modulo: taking a random 32-bit integer mod 72 makes the first 40 characters of the alphabet measurably more likely than the rest.
Entropy by length, all four character types on (72-character alphabet)
| Length | Entropy | Offline crack time at 10¹² guesses/sec |
|---|---|---|
| 8 chars | 49.4 bits | about 5 days |
| 12 chars | 74.1 bits | about 370,000 years |
| 16 chars | 98.8 bits | longer than the age of the universe |
| 20 chars | 123.5 bits | longer than the age of the universe |
Supported
- crypto.getRandomValues with rejection sampling — uniform, no modulo bias
- Fisher-Yates shuffle so guaranteed characters are not always at the front
- Look-alike character exclusion for passwords that get read aloud
- Entropy reported in bits for the exact alphabet you selected
Limits and trade-offs
- The entropy figure describes the generator, not a password you chose yourself. It says nothing about a human-picked password.
- Crack times assume an offline attack on a weak hash. Against bcrypt or Argon2 they are far longer.
- "Require one of each type" slightly reduces entropy; the number shown is the unconstrained figure.
Last verified August 2026 · benchmarks re-run each quarter.
Frequently asked questions
Are these passwords generated on a server?
No. They are generated in your browser by crypto.getRandomValues. Nothing is sent over the network, nothing is logged, and closing the tab destroys them. A password generator that round-trips to a server has already failed at its one job.
How long should a password be?
Sixteen characters or more for anything that matters, and twenty if a password manager is doing the remembering. Length is the dominant factor: adding one character to a 72-character alphabet multiplies the search space by 72, while adding a symbol type to a fixed length does far less.
What does entropy in bits actually mean?
It is the base-2 logarithm of the number of passwords the generator could have produced. Every extra bit doubles that number. Under 50 bits is weak against an offline attack; 80 bits or more is comfortable; 128 bits is beyond any foreseeable brute force.
How is the crack time estimated?
It assumes one trillion guesses per second — an offline attack with GPUs against a weakly hashed password file. That is a pessimistic assumption on purpose. An online attack against a rate-limited login is millions of times slower.
Why does "require one of each type" reduce entropy?
Because it removes every password that lacks one of the types, shrinking the possible set. The reduction is fractions of a bit at normal lengths, and worth accepting when a site enforces composition rules. The bits shown here are the honest figure for a purely random draw.
Is Math.random good enough for this?
No. Math.random uses a fast non-cryptographic PRNG whose internal state can be recovered from a small number of observed outputs, after which every future value is predictable. This tool uses crypto.getRandomValues with rejection sampling to eliminate modulo bias.