Security Runs locally Ready to use Built-in examples No tracking

Password Generator

Generate strong random passwords from 4 to 128 characters with crypto.getRandomValues. Entropy-based strength meter. Nothing is sent or stored.

When registering an account, initialising a server password or creating a database user, letting a cryptographic random source decide beats inventing something that merely looks complicated. This tool uses the browser's own crypto.getRandomValues — an operating-system entropy source, not the pseudo-random Math.random — guarantees at least one character from each selected class, then applies a Fisher-Yates shuffle so no positional pattern survives.

One principle when choosing the settings: length beats complexity. A 12-character random lowercase password carries roughly 56 bits of entropy and already outweighs an 8-character one using four character classes, because brute-force cost grows exponentially with length. Once it is generated, put it straight into a password manager — a password that can be remembered is usually a password with too little entropy.

—
—
 

How to use

  1. Set the length, between 4 and 128 characters.
  2. Choose which character classes to include.
  3. Check the entropy estimate shown.
  4. Copy it into a password manager rather than memorising it.

How it works

Where the randomness comes from

Randomness source: the browser's native crypto.getRandomValues — cryptographic-grade randomness, not the predictable Math.random — with every character drawn uniformly.

The generation algorithm

Algorithm: first draw one character from each selected class to guarantee coverage, fill the remainder from the full pool up to the target length, then shuffle with Fisher-Yates to eliminate positional patterns.

Strength (entropy) assessment

Strength: entropy = length × log2(pool size). A 16-character password over all four classes (74 possible characters) has about 99.4 bits of entropy — brute force is infeasible with current hardware.

Code example

JavaScript Generating a random password in the browser 

// Rejection sampling for a uniform random integer (a plain modulo would be biased)
function randInt(max) {
  const limit = Math.floor(0x100000000 / max) * max;
  const buf = new Uint32Array(1);
  do { crypto.getRandomValues(buf); } while (buf[0] >= limit);
  return buf[0] % max;
}

const pool = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnpqrstuvwxyz23456789";
const gen = (n) => Array.from({ length: n }, () => pool[randInt(pool.length)]).join("");
gen(16);

Shell Generating on the command line 

# openssl: take 16 characters out of base64 (strip the symbols first)
openssl rand -base64 24 | tr -d "/=" | cut -c1-16

# pwgen (needs installing): -s secure mode, -y include symbols
pwgen -s 16 1
pwgen -sy 16 1

FAQ

How long does a password need to be?

Think in entropy: above 60 bits is strong, above 90 bits effectively uncrackable by brute force. Recommendations: 12–16 characters across all four classes for ordinary accounts (about 74–99 bits); 16+ plus two-factor authentication for critical accounts (email, payments). Length beats complexity — 12 random lowercase letters (about 56 bits) beat an 8-character "complex" password.

Why not use Math.random?

Math.random is pseudo-random: its sequence is predictable and unfit for security. crypto.getRandomValues draws from the operating system's entropy source and is unpredictable. This tool uses the latter.

Are generated passwords recorded?

No. Passwords are generated and displayed in memory only. This tool deliberately has no history feature (other calculators keep local history; the password tool does not), writes nothing to localStorage, and makes no network requests. Refresh and it's gone.

Which characters should a password include?

Use all four classes — uppercase, lowercase, digits, symbols — with at least one of each. Length matters more than complexity: 16 random characters far outclass an 8-character "complex" one, because brute-force cost grows exponentially with length.

Can I reuse one password across sites?

Never. One site's leak lets attackers log into your accounts elsewhere via credential stuffing. One password per site, kept in a password manager behind a strong master password. Security-question answers deserve the same uniqueness.

What does entropy mean?

Entropy measures password uncertainty in bits: the larger the character set and the longer the password, the higher it climbs. About 80 bits withstands offline brute force; 100+ is very safe. This tool shows the entropy of every generated password for reference.

Should I rotate generated passwords regularly?

No need for ritual rotation. Modern guidance: change nothing while nothing leaked; change immediately when a provider reports a breach; and enable 2FA. Forced frequent changes push people toward weak or patterned passwords.