Password Generator
Generate cryptographically random passwords or passphrases with a real strength estimate. Runs offline in your browser — nothing is transmitted or stored.
How this generates them
With crypto.getRandomValues(), the browser’s cryptographically secure random source, using rejection sampling so every character in your chosen set is equally likely. Math.random() is not used anywhere — it isn’t suitable for secrets, and the modulo shortcut most generators use quietly biases the output toward the first characters of the alphabet.
Nothing leaves your browser. No network request is made when you click generate, which you can verify in the network inspector. Nothing is stored, so reloading the page loses the password — copy it before you navigate away.
What the entropy number means
Entropy in bits measures how many guesses an attacker needs, and it’s the only honest measure of password strength. Each extra bit doubles the work.
| Bits | Rough guessing time, offline attack | Suitable for |
|---|---|---|
| Under 40 | Seconds | Nothing |
| 50–60 | Days to months | Low-value accounts |
| 70–80 | Centuries | Most accounts |
| 90+ | Not feasible | Password manager master key, encryption |
Critically, entropy assumes the attacker knows how the password was made and only has to guess the random part. That’s the correct assumption, and it’s why P@ssw0rd! scores terribly despite hitting every complexity rule — the substitutions are predictable, so they add almost nothing.
Passphrases are often the better choice
For anything you have to type by hand — a master password, a disk key, a wifi password you read aloud — four or five random words beat a short jumble of symbols. Six random words from a 7,776-word list is about 77 bits, comfortably stronger than a 12-character mixed password, and you can actually remember it.
The words must be chosen randomly. A phrase you picked yourself is not random and is worth a small fraction of that.
Where to put them
Use a password manager and let it generate one unique password per site. Reuse is the actual risk: one breached site becomes every account you own, which is what credential-stuffing attacks exploit.
For database and FTP passwords on hosting accounts, generate a long random string and paste it into the config file — you never type those by hand, so length costs you nothing.