Strong Password Generator
Cryptographically secure random passwords, generated in your browser.
What makes a generated password strong
Strength comes from the size of the space an attacker has to search, which is the alphabet size raised to the password's length. That means length is the more powerful lever: adding a character multiplies the search space by the whole alphabet, while adding a character class only widens the base. A sixteen-character password drawn from letters, digits, and symbols is far beyond brute force with current hardware.
The other half is the randomness source. This generator usescrypto.getRandomValues, which draws from the operating system's entropy pool. The familiar Math.random is a predictable pseudo-random generator — fine for shuffling a deck in a game, unusable for anything that protects an account.
One thing no generator can help with: reuse. A perfectly random password used on two sites is only as safe as the weaker site. Generate a fresh one per account and store them in a password manager.
Frequently asked questions
Are these passwords actually random?
They come from crypto.getRandomValues, the browser’s cryptographically secure random number generator, which draws on the operating system’s entropy pool. That is a different and much stronger source than Math.random, which is predictable and must never be used for secrets.
How long should a password be?
Sixteen characters with mixed character types is a sensible floor for accounts that matter. Length contributes more strength than complexity does: a longer password from a smaller alphabet generally beats a short one full of symbols.
Why exclude ambiguous characters?
The glyphs 1, l, I, 0, and O are hard to tell apart in many fonts. Excluding them helps when a password has to be read aloud, copied by hand, or typed from a printout. It slightly shrinks the alphabet, so add a character or two of length to compensate.
Is the password sent to a server?
No. Generation happens entirely in your browser and the result is never transmitted, logged, or stored. You can confirm this by loading the page and then disconnecting from the network — it keeps working.
What does the strength meter measure?
It reports entropy in bits — the length multiplied by the log base 2 of the alphabet size, which is the size of the search space an attacker faces. Below 60 bits is weak and 100 or more is beyond brute force. It cannot know whether you reuse the password somewhere else, which matters more than either.
How long would it take to crack a generated password?
A 16-character password drawn from all 94 printable ASCII characters carries about 105 bits of entropy - roughly 4 x 10^31 possibilities. Even at a trillion guesses per second, exhausting that space would take far longer than the age of the universe. The realistic threats are not brute force but reuse, phishing and database breaches, which is why a unique password per site matters more than adding characters.
Is a passphrase better than a random string?
Often, yes. Six random words from a 7,776-word list carry about 77 bits of entropy, which is beyond practical brute force, and they are far easier to type and remember than a symbol-studded string. The critical word is random: words you chose yourself are drawn from a much smaller and highly predictable distribution.
Do character substitutions like @ for a help?
Barely. Password crackers have applied leetspeak rules to dictionary words for decades, so P@ssw0rd1 falls almost as fast as password. Substitutions multiply the search space by a small factor while making the password much harder to type. Length and genuine randomness are what actually help.
Should I write my passwords down?
A password manager is better, but a notebook kept somewhere safe is a perfectly reasonable fallback and far better than reusing one password everywhere. The threat model for most people is remote attackers and credential stuffing, not someone searching their home. What matters is that each password is unique.
What password strength actually measures
Strength here means entropy: how many equally likely possibilities an attacker would have to search. It is calculated aslog2(charset size) x length, so a 12-character password using lowercase only (26 characters) carries about 56 bits, while the same length across all 94 printable ASCII characters carries about 79.
entropy = length x log2(character set size) 8 chars, lowercase only ~ 38 bits trivially breakable 12 chars, mixed case + digits ~ 71 bits resistant to offline attack 16 chars, full ASCII ~ 105 bits beyond brute force 6 random words (diceware) ~ 77 bits beyond brute force, memorable
This only holds if the password really is random. Entropy measures the generator, not the string - a password like Tr0ub4dor&3 looks complex but was produced by a predictable process, so its real entropy is a fraction of what its character count suggests. That is why passwords you invent are weaker than they look, and why generating them mechanically matters.
Where the randomness comes from
Passwords here are generated with crypto.getRandomValues(), the browser's cryptographically secure random source, seeded from the operating system's entropy pool. The common mistake is Math.random(), which is fast, statistically uniform and completely unsuitable: its internal state can be recovered from a handful of outputs, making every subsequent value predictable.
Generation happens entirely in your browser. Nothing is transmitted, logged or stored, and closing the tab discards it.