How Password Generator Works
Each character is chosen using crypto.getRandomValues(), the Web Crypto API's cryptographically secure random number source — the same category of randomness used for encryption keys — rather than Math.random(), which isn't designed to be unpredictable. The estimated entropy shown is length × log₂(character set size), a standard way to measure how many guesses a brute-force attack would need.
How to Use This Tool
- Set your desired length and which character types to include.
- Select Generate Password.
- Copy the result — generate again anytime for a new one.
Example
A 16-character password using all four character types has roughly log₂(94)×16 ≈ 105 bits of entropy — well beyond what's practical to brute-force with current computing power.
Helpful Tips
- Longer passwords are far more effective than complex short ones — a 20-character password is dramatically stronger than an 8-character one, even with fewer symbol types.
- Use a password manager to store generated passwords, since long random strings aren't meant to be memorized.
- Avoid reusing the same password across multiple accounts — generate a new one for each.
Frequently Asked Questions
Are generated passwords stored or sent anywhere?
No. Passwords are generated locally in your browser using a cryptographically secure random source and are never transmitted or logged.
Why avoid Math.random() for passwords?
Math.random() is designed for speed and general-purpose use, not unpredictability — its output can potentially be predicted in some engines. crypto.getRandomValues() is specifically designed to be cryptographically unpredictable.
What does the entropy number mean?
It's an estimate of how many bits of randomness the password contains — higher is stronger. Above roughly 80 bits is considered very strong against brute-force attacks with current technology.
This tool runs entirely in your browser. Your input is not uploaded to any server.