Generate high-entropy passwords with length and character-set controls.
wE$_Gyfz5nYH6ujs85
The generator uses the browser crypto API and keeps generation local.
Understand the format
The strength of a generated password is measurable: it is the number of characters multiplied by the bits contributed by each position, assuming the source of randomness is genuinely unpredictable.
For a randomly generated password, strength in bits is length multiplied by the base-two logarithm of the character pool size. A pool of 71 characters contributes about 6.15 bits per position, so an 18-character password from that pool carries roughly 111 bits of entropy. An attacker who can test a billion candidates per second would still need vastly longer than the age of the universe to exhaust that space.
The formula shows why length dominates. Adding one character multiplies the search space by the pool size, while adding a whole extra character class only increases the per-character contribution slightly. Sixteen lowercase letters beat eight characters drawn from every class on the keyboard.
This generator draws from crypto.getRandomValues, the browser cryptographically secure random source. That distinction matters: an ordinary pseudo-random function is predictable from its output, which makes any password built from it recoverable. It also guarantees at least one character from each selected group, then shuffles the result, so the password satisfies composition rules without a predictable layout.
Look-alike characters are deliberately left out of the pools: lowercase l, uppercase I and O, and the digits 0 and 1. That removes transcription errors when a password is read aloud or typed from a screen, at the cost of a fraction of a bit per character, which the entropy table below already accounts for.
Step by step
Passwords are generated in your browser with crypto.getRandomValues. They are not transmitted, saved in local storage, or recoverable after you leave the page.
Worked examples
Input
length 18, all four character groups
Result
about 111 bits of entropy from a 71-character pool
Far beyond any offline guessing attack. The realistic threats are reuse, phishing, and a breach of the service that stores it.
Input
12 characters from all four groups vs 16 lowercase letters
Result
about 74 bits vs about 74 bits
Four extra letters buy as much strength as adding uppercase, digits, and symbols to a shorter password, and the longer one is easier to type.
Reference
| Selected groups | Pool size | 12 characters | 16 characters | 18 characters |
|---|---|---|---|---|
| Lowercase only | 25 | 56 bits | 74 bits | 84 bits |
| Letters, no digits or symbols | 49 | 67 bits | 90 bits | 101 bits |
| Letters and digits | 57 | 70 bits | 93 bits | 105 bits |
| All four groups | 71 | 74 bits | 98 bits | 111 bits |
Practical Guide
Troubleshooting
FAQ
The value is produced locally with the cryptographic random source and is never transmitted. The remaining risks are local: browser extensions, clipboard managers, and shoulder surfing. For your most sensitive accounts, generate inside a password manager.
Sixteen characters is a reasonable minimum for accounts that matter, and twenty or more for administrative access. Since a manager types it for you, extra length costs nothing.
Look-alikes such as l, I, O, 0, and 1 are excluded so a password can be read and retyped without ambiguity. The entropy figures above already reflect the smaller pools.
A passphrase of five or six words chosen at random by a tool is both strong and memorable, which suits the handful of passwords you must type from memory. For everything a manager fills in, a random string is simpler.
No. Nothing is stored or logged, and refreshing the page discards the value entirely.
Go deeper
