How to use the Password Generator
- Set the length — drag the length slider to choose between 8 and 128 characters. Longer passwords are exponentially harder to crack.
- Choose character sets — toggle uppercase, lowercase, numbers, and symbols to control which characters appear in your password. More sets = higher entropy.
- Click Generate — instantly create 1, 5, or 10 cryptographically secure passwords at once. Each is generated independently using the Web Crypto API.
- Copy and use — click the copy icon next to any password to copy it, or use Copy All to grab every password in the list.
How to choose a strong password
Password strength isn't just about complexity — it's about entropy. Entropy measures unpredictability in bits: the higher the number, the harder the password is to guess or crack.
Entropy is calculated as length × log₂(charsetSize). A 16-character password using uppercase, lowercase, and numbers has a charset of 62 and roughly 95 bits of entropy — essentially uncrackable by brute force.
- Length matters more than complexity — a 20-character lowercase password has more entropy than a 10-character password with symbols.
- Add symbols for high-value accounts — symbols increase the charset from 62 to ~95, adding around 10–15 bits of entropy per password.
- Aim for 60+ bits — considered strong by modern standards. 80+ bits is very strong and exceeds the realistic capacity of any brute-force attack.
- Exclude ambiguous characters if you ever need to type the password manually — it eliminates confusion between 0/O, 1/l/I without affecting security significantly.
Why this generator is safe to use
Many online password generators run on servers — meaning your password travels over a network before you see it. This tool generates everything locally in your browser using the crypto.getRandomValues() API. Your password never leaves your device and is never stored or logged anywhere.
The Web Crypto API is the same standard browsers use for HTTPS encryption. It sources entropy from hardware events like CPU timing, mouse movement, and system interrupts — making results genuinely unpredictable, unlike Math.random(), which uses a deterministic seed.
Once generated, store passwords in a password manager (1Password, Bitwarden, or similar) rather than writing them down or reusing them across accounts.