Password Generator

Why Do You Need a Strong Password?

Weak passwords are one of the leading causes of account breaches. Dictionary attacks, credential stuffing, and brute-force attacks can crack short, predictable passwords in seconds. A strong, randomly generated password with sufficient length and character variety can take billions of years to crack with current technology.

This generator uses your browser's built-in cryptographic random number generator (Web Crypto API) to produce passwords that are statistically unpredictable. Unlike simple random functions, crypto.getRandomValues() is designed specifically for security-sensitive operations.

What This Generator Does

This tool generates one or more random passwords based on your chosen character sets, length, and exclusion rules. It also shows your password's entropy, a measure of how difficult it would be to guess through brute force.

• Inputs: Password length (4-128), character sets (lowercase, uppercase, numbers, symbols), exclusions, and count
• Outputs: One or more random passwords, entropy estimate in bits, strength rating, and character pool size

How the Calculation Works

Password Entropy

Entropy measures the unpredictability of a password. A 12-character password using only lowercase letters (26 characters) has 12 × log2(26) = 56.5 bits of entropy. The same length using all character sets (~94 characters) gives 12 × log2(94) = 78.7 bits. More bits means exponentially harder to crack.

Strength Thresholds

• Very Weak (below 28 bits): Crackable instantly with modern hardware
• Weak (28-36 bits): Crackable in hours or days with dedicated hardware
• Reasonable (36-60 bits): Adequate for low-risk accounts
• Strong (60-128 bits): Suitable for most accounts. Recommended minimum for sensitive services
• Very Strong (128+ bits): Essentially uncrackable with current and foreseeable computing power

How to Use the Generator

1. Set your desired password length using the slider. Longer is always stronger
2. Select which character types to include. Using all four sets maximizes entropy
3. Optionally exclude ambiguous characters (like 0 and O) if the password must be typed manually
4. Enter any specific characters you want to exclude, such as characters not supported by a website
5. Click Generate Password. Click Copy next to any password to add it to your clipboard
6. Store the password in a password manager, not in a text file or browser note

Example Passwords

Example 1: High-Security Account (128-bit entropy)

Length 20, all character sets enabled, ~131 bits of entropy. Example output: tX7!kM2#pLqW9&vRnJ4@. At one trillion guesses per second, this would take longer than the age of the universe to crack by brute force.

Example 2: Easy to Type, Still Strong

Length 20, lowercase and uppercase only, no ambiguous characters, ~114 bits of entropy. Example output: mRpkTvWsLnqHjXdBfYcG. This is easier to type on a phone keyboard while still being extremely difficult to crack.

Real-World Scenarios

Creating Unique Passwords for Every Account

The single most important password security practice is using a different password for every account. If one service is breached, attackers cannot use those credentials to access your other accounts. Generate a new password here for each new account you create.

Setting Up a Password Manager

A password manager stores all your random passwords securely behind one strong master password. Use this generator to create the strongest possible master password, since it is the only one you need to remember.

Generating API Keys and Tokens

Developers sometimes use this tool to generate random API keys, session secrets, and configuration tokens for applications where a cryptographically random value is needed quickly.

Why This Tool Matters

Human-chosen passwords are predictable. People tend to use names, dates, common words with substitutions, and patterns. Attackers know this and optimize their attacks accordingly. A truly random password removes this predictability entirely, making your accounts much harder to compromise.

Common Mistakes to Avoid

• Reusing passwords: A strong password reused across multiple sites is only as secure as the weakest site. One breach exposes all your accounts
• Storing passwords in plain text: Text files, spreadsheets, and sticky notes are all insecure. Use a reputable password manager
• Using only numbers or only letters: A 12-digit numeric PIN has only 40 bits of entropy. The same length with full character sets has nearly twice as much
• Trusting password strength meters that ignore randomness: Many meters reward length and character variety but do not check if the password is a dictionary word with substitutions. Randomly generated passwords avoid this entirely