🔑 Password Generator
Cryptographically random passwords, generated on your device, with the entropy math shown, because length beats complexity.
Generated with crypto.getRandomValues on your device, never transmitted, never stored. Entropy = length × log₂(alphabet): each extra character beats any complexity rule.
How the password generator works
Characters are drawn with crypto.getRandomValues, the browser’s cryptographically secure random source, not Math.random(), using rejection sampling so every character is exactly equally likely. The entropy display is the honest strength measure: log₂(alphabet size) × length, in bits. Each additional character adds more strength than any symbol requirement does.
The counterintuitive truth the entropy meter makes visible: a 16-character lowercase-only password (~75 bits) is far stronger than an 8-character everything-enabled one (~52 bits). Length is the lever. And the only sane way to use unique random passwords everywhere is a password manager, generate here, store there.
Frequently asked questions
How long should a password be?
For accounts guarded by rate-limited logins, 12-14 random characters is ample. For anything offline-crackable (password managers, disk encryption), 16+ characters or ~90+ bits of entropy. The meter on this page shows the bits live.
What do the entropy bits mean?
log₂ of the number of equally likely possibilities: each bit doubles the guessing work. ~50 bits resists casual attack; 80+ bits is strong against serious offline cracking; 100+ is overkill in the good way.
Is this really random?
Yes, crypto.getRandomValues taps the operating system's CSPRNG (the same source TLS keys use), with rejection sampling to avoid modulo bias. Math.random(), which weaker generators use, is predictable by design.
Should I exclude ambiguous characters like l, 1, O, 0?
Only if a human must read or retype the password (WiFi keys, printed codes). It slightly reduces entropy per character, compensate with two extra characters.
Is the password sent anywhere?
No, generation happens in your browser's memory and nothing is transmitted or stored. Generate offline if you want the proof.
Related generators
From the blog
-
How Strong Is a Password, Really? Entropy Explained (Length Beats Complexity)
Password entropy = length × log₂(alphabet size). Why a 16-char lowercase password beats an 8-char symbol soup, and what NIST actually recommends.
-
How to Password-Protect a PDF (or Remove a Password) Without Uploading It
PDF encryption uses AES, but online unlock tools want your document and its password together. How PDF passwords work and how to add or remove them locally.