๐ Password Generator
Estimated entropy: ~95 bits
Press "Generate" to create passwords
Generate secure random passwords using the browser's built-in cryptographic random number generator (crypto.getRandomValues). Choose which character sets to include and the length, and generate several at once.
How to use
- Set the password length and how many to generate.
- Choose which character sets to include (uppercase, lowercase, digits, symbols).
- Press "Generate" to create the passwords.
How the calculation works
This tool generates random passwords using the browser's cryptographically secure random number generator (crypto.getRandomValues). You can choose from 26 lowercase letters, 26 uppercase letters, 10 digits and 18 symbols (!@#$%^&*()-_=+[]{}). Each character is picked with equal probability from the whole selected set. Simply taking the random number modulo the set size would make the first characters very slightly more likely, so random values that fall in the leftover range are discarded and redrawn (rejection sampling) to remove that bias. Password strength is expressed as entropy in bits: Entropy = length ร logโ(number of possible characters) Each extra bit doubles the number of guesses needed to find the password by brute force.
Worked example
16 characters from lowercase + uppercase + digits (62 characters) Entropy: 16 ร logโ62 โ 95.3 bits Adding symbols (80 characters) 16 ร logโ80 โ 101.2 bits Even at a trillion guesses per second, brute-forcing a 95-bit password would take on average more than 600 million years.
Things to be aware of
- Use a different password for every service, so one leak does not expose the others.
- Random passwords are hard to remember, so a password manager is recommended.
- Some services restrict which symbols are allowed. If a password is rejected, turn off symbols and increase the length.
- Passwords are generated in your browser and never sent anywhere.
FAQ
Are the generated passwords secure?
Yes โ the Web Crypto API's crypto.getRandomValues() is a cryptographically secure random number generator, unlike predictable pseudo-random generators such as Math.random().
What does the entropy (bits) mean?
It measures how hard the password is to guess, calculated as length ร log2(character set size). 80 bits or more is generally considered very strong.
Is the generated password sent to a server?
No โ generation happens entirely in your browser, on your own device. Nothing is sent externally.