Password generator
Pick a length and the character types. Randomness comes from the browser’s crypto API (crypto.getRandomValues), drawn without rounding bias. Strength is shown as entropy in bits plus a crack-time estimate with its assumptions stated. Nothing is uploaded or stored.
Options
For the same gain, adding length beats adding character types.
More settings (character sets, exclusions, batch)
Quotes, backslash and space are left out, because they often break in shells and CSV files.
For passwords you will read aloud or copy by hand. Fewer candidates means slightly less strength at the same length.
For sites that demand an uppercase letter and a digit. Ruling out the combinations that miss a type puts the real strength a little below the figure above — the gap is wider at short lengths.
129.5 bits — Much higher
Nothing here is stored or uploaded. Close the tab and it is gone, so copy what you need first.
Result
Generating…
- Randomness
- crypto.getRandomValues
- Uploaded
- none
- Stored
- none
Strength (calculated)
The scale is entropy in bits. Fine marks are 8 bits apart; the tall rules are the 45 / 60 / 80 boundaries. Past the top of the scale (192) the needle stops at the right edge. The exact figure is shown in the entropy readout above.
How it is calculated: 20 × log₂(89) ≈ 129.5 bits
Assumption: an attacker with a stolen hash trying 1 trillion guesses per second offline. The hashing scheme moves this by orders of magnitude — much longer with bcrypt or Argon2, much shorter with purpose-built hardware. Treat it as a rough calculated figure.
Related tools
All tools- Hash & checksumCompute SHA-256, MD5 and more for text or files, and compare against a published value.
- Audio cut & joinCut the part you need out of an audio file, or join several into one.
- Silence removerFind the silent stretches in a recording and close them up.
- Volume & level matchRaise or lower audio by dB, or match peak or loudness across several files.
Highlights
- Cryptographic randomness without bias
- Values come from crypto.getRandomValues rather than Math.random(). Folding them with a modulo would make some characters slightly more likely, so out-of-range draws are discarded and redrawn (rejection sampling).
- "One of each type" without skewing the result
- One character is drawn from each required set first, the rest is filled from the whole pool, and the result is shuffled. Unlike generators that overwrite fixed positions afterwards, the distribution stays even.
- Nothing is sent or stored
- Generation happens entirely in the page. Nothing is sent to a server or written to browser storage; close the tab and it is gone.
How to use it
Pick a style
One is already generated by the time the page opens. Choose "Password" for a random string, or "Passphrase" for joined words.
Set the length
Drag the slider for the number of characters (8–64) or of words (3–10). Every change draws a new one, and the strength in bits appears just underneath. Character sets and batch generation live under "More settings".
Copy it
Use the copy button beside the result. Nothing is stored, so closing the tab loses it. "Generate again" draws a fresh one.
Reading the strength figure
- What is entropy in bits?
- It is length × log₂(number of candidate characters) — the number of guesses needed, expressed as an exponent. Each extra bit doubles the guesses required. It describes randomly generated strings only; a password you thought up yourself is not covered by it.
- How much should the crack time be trusted?
- It assumes an attacker with a stolen hash trying a trillion guesses per second offline, and reports the average. Change the assumption and the answer moves by orders of magnitude: a deliberately slow hash like bcrypt or Argon2 makes it far longer, purpose-built hardware makes it far shorter. Read it as a rough calculated figure.
- Length or more character types?
- Length wins. Going from 26 candidates to 89 only lifts each character from 4.7 to 6.5 bits, while one extra character adds those 6.5 bits outright. Twenty lowercase letters (about 94 bits) beats ten characters drawn from all four types (about 65 bits).
- Does avoiding look-alikes weaken it?
- Slightly, at the same length, because there are fewer candidates; the bits readout shows exactly how much. If the password will be written down or read out loud, a misread character is usually the bigger practical risk, so pick by use.
Questions
- Are generated passwords stored?
- No. Nothing is sent to a server and nothing is written to browser storage. Reopening the page generates new ones and the old ones cannot be recovered, so copy what you need before closing the tab.
- Do I still need a password manager?
- This tool only makes them; it does not keep or sync anything. Using a different password per site requires somewhere to put them, so pair this with a password manager or your operating system’s keychain.
- Why is reusing a password dangerous?
- When one service leaks, that email-and-password pair gets replayed against other sites automatically (credential stuffing). Because it is a replay rather than a search, password length does not help. Using a different password per site avoids it.
- Passphrase or password?
- It depends on whether you will type it. A passphrase is easier to type and read aloud at the same bit count, but it is longer, so sites with a length cap may reject it. If it only ever lives in a manager, a random string is fine. Both are drawn from the same source of randomness.