Kit — password generator

Password generator

Pick a length and the character types. Randomness comes from the browser’s crypto API and is drawn without the rounding bias most generators have. Strength is shown as entropy in bits plus a crack-time figure with its assumptions spelled out. Nothing is uploaded or stored.

For the same gain, adding length beats adding character types.

Quotes, backslash and space are left out — they are what breaks when a password meets a shell or a CSV.

For passwords you will read aloud or copy by hand. Fewer candidates means slightly less strength at the same length.

For sites that demand an uppercase letter and a digit. Ruling out the combinations that miss a type puts the real strength a little below the figure above — the gap is wider at short lengths.

Generated

Generating…

Strength (calculated)
Candidate characters
89
Entropy
129.5 bits
Rough band
Much higher
Average time to crack (assumed)
~10^19 years

How it is calculated: 20 × log₂(89) ≈ 129.5 bits

Assumption: an attacker with a stolen hash trying 1 trillion guesses per second offline. The hashing scheme moves this by orders of magnitude — much longer with bcrypt or Argon2, much shorter with purpose-built hardware. Treat it as a rough calculated figure.

Nothing here is stored or uploaded. Close the tab and it is gone, so copy what you need first.

This runs entirely in your browser. Nothing is uploaded.

Related tools

Hash & checksumWord & character countJSON formatter & validatorBase64 encode & decodeAll tools

How this one is built

Cryptographic randomness, drawn without bias

Math.random() is not used anywhere. Values come from crypto.getRandomValues, and rather than folding them with a modulo — which makes the first few characters of the alphabet slightly more likely — out-of-range draws are discarded and redrawn.

The "one of each type" rule does not overwrite anything

Generators that patch the first few positions after the fact pin a digit to a fixed slot and can clobber the character they meant to guarantee. Here one character is drawn from each required set first, the rest is filled from the whole pool, and the result is shuffled.

Nothing leaves, nothing lingers

Generation happens inside the page. Nothing is sent to a server, so nothing is kept on our side, and nothing is written to browser storage — close the tab and it is gone.

Reading the strength figure

What is entropy in bits?It is length × log₂(number of candidate characters) — the number of guesses needed, expressed as an exponent. Each extra bit doubles the guesses required. It describes randomly generated strings only; a password you thought up yourself is not covered by it.
How much should the crack time be trusted?It assumes an attacker with a stolen hash trying a trillion guesses per second offline, and reports the average. Change the assumption and the answer moves by orders of magnitude: a deliberately slow hash like bcrypt or Argon2 makes it far longer, purpose-built hardware makes it far shorter. Read it as a rough calculated figure.
Length or more character types?Length wins. Going from 26 candidates to 89 only lifts each character from 4.7 to 6.5 bits, while one extra character adds those 6.5 bits outright. Twenty lowercase letters (about 94 bits) beats ten characters drawn from all four types (about 65 bits).
Does avoiding look-alikes weaken it?Slightly, at the same length, because there are fewer candidates — the bits readout shows exactly how much. If the password will be written down or read out loud, a misread character is usually the bigger practical risk, so pick by use.

Questions

Are generated passwords stored?

No. Nothing is sent to a server and nothing is written to browser storage. Reopening the page generates new ones and the old ones cannot be recovered, so copy what you need before closing the tab.

Do I still need a password manager?

This tool only makes them; it does not keep or sync anything. Using a different password per site requires somewhere to put them, so pair this with a password manager or your operating system’s keychain.

Why is reusing a password dangerous?

When one service leaks, that email-and-password pair gets replayed against other sites automatically (credential stuffing). Because it is a replay rather than a search, the length of the password makes no difference — not reusing it is the only defence.

Passphrase or password?

It depends on whether you will type it. A passphrase is easier to type and read aloud at the same bit count, but it is longer, so sites with a length cap may reject it. If it only ever lives in a manager, a random string is fine. Both are drawn from the same source of randomness.