🔑 Password Generator
Cryptographically random passwords, generated on your device — with the entropy math shown, because length beats complexity.
Generated with crypto.getRandomValues on your device — never transmitted, never stored. Entropy = length × log₂(alphabet): each extra character beats any complexity rule.
How the password generator works
Characters are drawn with crypto.getRandomValues — the browser’s cryptographically secure random source, not Math.random() — using rejection sampling so every character is exactly equally likely. The entropy display is the honest strength measure: log₂(alphabet size) × length, in bits. Each additional character adds more strength than any symbol requirement does.
The counterintuitive truth the entropy meter makes visible: a 16-character lowercase-only password (~75 bits) is far stronger than an 8-character everything-enabled one (~52 bits). Length is the lever. And the only sane way to use unique random passwords everywhere is a password manager — generate here, store there.
Frequently asked questions
How long should a password be?
For accounts guarded by rate-limited logins, 12–14 random characters is ample. For anything offline-crackable (password managers, disk encryption), 16+ characters or ~90+ bits of entropy. The meter on this page shows the bits live.
What do the entropy bits mean?
log₂ of the number of equally likely possibilities: each bit doubles the guessing work. ~50 bits resists casual attack; 80+ bits is strong against serious offline cracking; 100+ is overkill in the good way.
Is this really random?
Yes — crypto.getRandomValues taps the operating system's CSPRNG (the same source TLS keys use), with rejection sampling to avoid modulo bias. Math.random(), which weaker generators use, is predictable by design.
Should I exclude ambiguous characters like l, 1, O, 0?
Only if a human must read or retype the password (WiFi keys, printed codes). It slightly reduces entropy per character — compensate with two extra characters.
Is the password sent anywhere?
No — generation happens in your browser's memory and nothing is transmitted or stored. Generate offline if you want the proof.
Related generators
From the blog
-
How Strong Is a Password, Really? Entropy Explained (Length Beats Complexity)
Password strength is measured in entropy bits: length × log₂(alphabet size). Why a 16-character lowercase password beats an 8-character symbol soup, what NIST actually recommends, and how to generate passwords that hold up.
-
How to Password-Protect a PDF (or Remove a Password) Without Uploading It
PDF encryption uses AES — but 'free online' unlock tools ask you to upload the document and its password together, the two things you should never send anywhere. How PDF passwords work and how to add or remove them locally.