Password Generator
Generate cryptographically secure random passwords with configurable length and character types.
- Free
- No account
- Runs in your browser
- Nothing uploaded
Click Generate — the password is created in your browser using crypto.getRandomValues() and never sent anywhere.
Runs entirely in your browser — your input is never uploaded, logged, or stored.Privacy policy
What is Password Generator?
A strong password is long, unpredictable, and unique. This tool generates passwords using the Web Crypto API's cryptographically secure random number generator — the same interface browsers use for TLS certificates and payment processing. The output is suitable for account passwords, API keys, and any context where an attacker might guess or brute-force the value.
The entropy counter shows how many bits of randomness your password contains. Each bit doubles the number of possible combinations an attacker would need to try. A 128-bit password requires 2^128 guesses — more than the atoms in the observable universe. For reference: • 64 bits: vulnerable to nation-state attackers with massive compute • 80 bits: resistant to well-funded attackers • 128 bits: computationally infeasible to brute-force with any technology
The tool also shows estimated crack times based on common attack scenarios (10 billion guesses/sec for online attacks, 100 billion guesses/sec for offline GPU attacks). These are rough estimates — actual times depend on the attacker's resources and the hashing algorithm used for storage.
Important: This tool generates passwords, but password security also depends on how you store them. Use a password manager (1Password, Bitwarden, KeePass) rather than memorizing passwords, and enable two-factor authentication wherever possible.
Password generation uses the Web Crypto API's getRandomValues() for each character selection:
1. Define the character pool based on selected options (uppercase, lowercase, digits, symbols). 2. For each position, generate a cryptographically random index into the pool. 3. Optionally ensure at least one character from each selected category. 4. Calculate entropy: log2(poolSize^length) = length × log2(poolSize).
Entropy calculation: • Pool size = sum of selected character categories - Uppercase (A-Z): 26 characters - Lowercase (a-z): 26 characters - Digits (0-9): 10 characters - Symbols (!@#$%^&*...): 26 characters • Entropy = length × log2(poolSize) • Example: 16 chars, all categories = 16 × log2(94) ≈ 105 bits
Why not Math.random()? It is seeded from a small internal state and predictable. An observer who sees enough output can predict what comes next. getRandomValues() draws from the operating system's entropy pool and is suitable for security-sensitive applications.
Worked examples
- 16-character password with all character types: ~105 bits of entropy
- 20-character password with all character types: ~131 bits of entropy
- 12-character password with only lowercase and digits: ~70 bits of entropy
- Passphrase with 6 random words (256,000-word dictionary): ~93 bits of entropy
How to use Password Generator
- Set the desired password length (8–128 characters).
- Toggle character types (uppercase, lowercase, digits, symbols).
- Click Generate to create a new password.
- Copy the password using the copy button.
- Store it in a password manager — don't memorize it.
Common errors
- Password looks random but is short — length matters more than complexity. A 20-character lowercase password (94 bits) is stronger than an 8-character mixed password (52 bits).
- Same password generated twice — this is astronomically unlikely with cryptographic randomness. If it happens, check your browser's random number generator.
- Symbols missing from output — some symbol sets conflict with shell or SQL escaping. Use the default symbol set for maximum compatibility.
- Password doesn't meet site requirements — some sites require specific character types or minimum lengths. Adjust the toggles to match their requirements.
FAQ
How long should a password be?
For online accounts, 16–20 characters with mixed character types provides excellent security (~105–131 bits of entropy). For high-value targets (crypto wallets, root accounts), 24+ characters is recommended. The most important factor is length — a 20-character lowercase password is stronger than an 8-character mixed password.
Should I memorize the password?
No. Use a password manager (1Password, Bitwarden, KeePass) to store it. Human memory is unreliable for random strings, and reusing passwords across sites is a major security risk. A password manager generates and stores unique passwords for every account.
Is this better than a password generator app?
This tool uses the same cryptographic random number generator as dedicated apps. The difference is convenience — password managers integrate with your browser and sync across devices. This tool is useful for generating standalone passwords or understanding how password strength works.
What about passphrases?
Passphrases (e.g., 'correct horse battery staple') are easier to remember but require 6+ random words from a large dictionary to match the entropy of a 16-character random password. They're excellent for passwords you must memorize (like a master password), but for most accounts, a random string stored in a password manager is more practical.
Why do some passwords look less random?
They're not — every character is independently random. Humans are pattern-seeking creatures and sometimes perceive randomness as non-random. A password like 'aB3$kL9!mN2@pQ5' looks 'too structured' but has the same entropy as any other 16-character mixed password.
Related tools
Prefer AllUtil on Google
One click adds AllUtil to your Google preferences. You'll see our tools highlighted with a Preferred badge in Search and AI answers.