Password Generator
Generate cryptographically random passwords of any length with your choice of uppercase letters, lowercase letters, numbers, and symbols. Copy with one click. Nothing is saved or sent anywhere.
How It Works
A strong password has two key properties: sufficient length and sufficient randomness. This generator uses the browser's cryptographic random number API — window.crypto.getRandomValues() — which produces numbers that are computationally infeasible to predict, unlike Math.random().
Character sets available:
- Uppercase: A–Z (26 characters)
- Lowercase: a–z (26 characters)
- Numbers: 0–9 (10 characters)
- Symbols: !@#$%^&*()_+-=[]{}|;:,.<>? (32 characters)
Total pool size with all sets: 26 + 26 + 10 + 32 = 94 characters.
The algorithm:
1. Build the character pool from the selected sets.
2. Generate a Uint32Array of `length` random 32-bit integers using crypto.getRandomValues().
3. For each random integer, take integer modulo pool length to get an index.
4. Append the character at that index to the password string.
Note: Using modulo introduces a tiny bias when pool size does not evenly divide 2^32. For a 94-character pool, the bias is about 0.000001% per character — negligible for password generation.
Password strength is measured in bits of entropy: Entropy = length × log₂(pool size).
- 8 chars, 94-char pool: 8 × 6.554 = 52.4 bits (weak by modern standards)
- 12 chars, 94-char pool: 78.7 bits (adequate)
- 16 chars, 94-char pool: 104.9 bits (strong)
- 20 chars, 94-char pool: 131.1 bits (very strong)
- 32 chars, 94-char pool: 209.7 bits (extreme)
A 128-bit entropy password would take all computers on Earth billions of years to brute-force.
The strength indicator shows:
- Weak: < 40 bits
- Fair: 40–59 bits
- Good: 60–79 bits
- Strong: 80–99 bits
- Very Strong: 100+ bits
Best practices: Use a password manager (1Password, Bitwarden, Dashlane) to store unique, generated passwords for every site. Enable two-factor authentication. Never reuse passwords.
Frequently Asked Questions
Is this password generator secure?
Yes. The generator uses window.crypto.getRandomValues(), the same cryptographically secure random number generator used by security software. The password is generated entirely in your browser and is never sent to any server.
How long should a password be?
At minimum 12 characters for a typical account. For high-value accounts (banking, email, work systems), use 16+ characters. For master passwords in a password manager, 20+ characters is advisable. Length contributes more to security than complexity for the same character pool.
Should I include symbols in passwords?
Symbols increase the character pool from 62 (upper + lower + digits) to 94, adding about 0.58 bits of entropy per character. More importantly, symbols may be required by many systems. The main downside: some systems reject certain symbols, so if a generated password fails, try regenerating with a slightly different symbol set.
What is entropy in the context of passwords?
Entropy (measured in bits) quantifies how unpredictable a password is. A password with N bits of entropy requires an attacker to try up to 2^N guesses. At modern GPU speeds (10 billion guesses/sec), a 64-bit password would fall in 1.8 seconds, while an 80-bit password would take years and a 128-bit password is uncrackable by any foreseeable technology.
Can I use a generated password that is hard to type?
If you use a password manager (which you should for generated passwords), you never need to type it — the manager fills it in. If you need to type it occasionally, use a longer but simpler password with only letters and numbers, which provides similar strength at a longer length.