Password Generator

How this password generator works

This tool builds every password and passphrase locally, in your browser, using crypto.getRandomValues — the same cryptographically secure random number generator (CSPRNG) that browsers use for security-critical work. To turn those random bytes into characters or words without introducing bias, it uses rejection sampling: when a random value falls into the small unusable tail that would make some characters slightly more likely than others, that value is discarded and a fresh one is drawn. The result is a genuinely uniform, unbiased choice from the pool you selected — which is what makes the entropy figures below trustworthy rather than optimistic.

What "entropy" actually measures

Password strength is best described by entropy — the number of equally-likely possibilities the password was chosen from, measured in bits. Every extra bit doubles the work an attacker must do to guess it. For a random password the estimate is bits = length × log2(pool size), and for a passphrase it is bits = words × log2(list size). The meter above reports these figures honestly, rounding to the nearest bit; it describes only the randomness of the generation, not any guess about how a specific attacker behaves.

Worked example: 16 characters vs 20

Turn on all four character classes and the pool is about 90 characters, so each character carries log2(90) ≈ 6.49 bits. A 16-character password is therefore 16 × 6.49 ≈ 104 bits, and a 20-character one is 20 × 6.49 ≈ 130 bits. Those four extra characters add about 26 bits — and because each bit doubles the search space, the longer password is roughly 2^26 ≈ 67 million times harder to guess. To put 104 bits in perspective: it is about 2×10^31 possibilities, so an attacker managing 100 billion guesses a second against a fast unsalted hash would still need on the order of three trillion years on average. A five-word passphrase from this tool's 7,776-word list, by contrast, is about 5 × 12.9 ≈ 65 bits — fine against online attacks, but still within reach of that same offline attacker given time, which is why six words (about 78 bits) is the safer floor for anything you memorise.

Bits per character by character set

Read down that table and one lesson stands out: adding symbols to an alphanumeric set buys only about half a bit per character, while adding one more character of length buys a full 5–6 bits. Length is almost always the cheaper route to strength; reach for symbols mainly when a site caps how long the password can be.

Strength labels

Random string or passphrase?

Random character strings pack the most entropy into the fewest characters, which is ideal when a password manager remembers them for you. Passphrases — a handful of unrelated random words — are far easier to type and recall, which is what you want for the few secrets you memorise, like the master password to your vault or your device login. Both are strong only when they are truly random: the strength of a passphrase comes from the dice-roll over the word list, not from the words meaning anything, so stringing together words you picked yourself throws most of it away.

Common mistakes

Trusting decorated dictionary words. "P@ssw0rd1" looks complex but its substitutions are the first rules any cracking tool applies, so its real entropy is close to that of the word "password" — near zero. Confusing complexity rules with strength. A site demanding "one uppercase, one digit, one symbol" nudges you toward a predictable pattern (Capital-word-then-number-then-!); a long random string or random passphrase satisfies the rule and is genuinely strong. Reusing one strong password everywhere. A single breach then unlocks every account, so uniqueness matters as much as strength — generate a fresh one per site and let a manager remember it. Truncating to fit a length limit. Chopping a 20-character password to fit an 8-character field discards most of its entropy; regenerate at the allowed length instead.

Honest limits

The entropy number here is a property of how the password was generated, not a security audit of a password you typed in — this tool only measures what it makes. It does not check your password against breach corpora such as Have I Been Pwned, because that would mean sending data over the network, which the page never does; it also does not store, sync, or remember anything, so pair it with a reputable password manager for the actual keeping. The passphrase estimate assumes an attacker knows both the word list and the format, which is the honest, worst-case assumption to make. And no password can protect an account whose provider is breached server-side or phished — a strong secret is necessary, not sufficient, and works best alongside two-factor authentication.