Password Generator

Why random passwords beat clever ones

The strength of a password is not how strange it looks to a human — it's how many guesses a computer would need to stumble onto it. Attackers rarely sit and type guesses by hand. They run software that tries billions of combinations per second against leaked password databases, starting with dictionary words, names, dates, and the predictable substitutions people love (P@ssw0rd!, Summer2024). A password that follows a pattern a human invented is a password a cracking tool already expects. A randomly generated string has no pattern to expect, which is exactly why this generator builds every character from a cryptographically secure random source in your browser.

Entropy: the number that really matters

Password strength is measured in bits of entropy — each bit doubles the number of possible passwords an attacker must try. Entropy depends on two things: how many character types you allow, and how long the password is.

Multiply bits-per-character by length to get total entropy. A 16-character password using the full symbol set carries roughly 105 bits — far beyond what any current or foreseeable hardware can brute-force. As a rule of thumb, anything below 50 bits is weak, 70–80 bits is solid for most accounts, and 100+ bits is comfortable for anything you truly care about.

Length wins over complexity

Here's the counter-intuitive part: adding length is more powerful than adding symbols. Going from 12 to 16 characters multiplies the search space far more than sprinkling in a single !. This is why a long passphrase of random words — correct-harbor-velvet-engine — can be both stronger and easier to type than a short jumble like X7@q. If a site limits you to a short maximum length, max out the character variety to compensate; if length is unlimited, prefer length.

How to use the generated password well

1. Use a unique password for every account. The biggest real-world risk isn't brute force — it's credential stuffing, where attackers take a password leaked from one breached site and try it everywhere else. A unique random password per site contains the damage to a single account.
2. Store it in a password manager. You are not meant to memorise a 20-character random string. A manager remembers them, fills them in, and syncs across devices, so the only password you ever type by hand is the one that unlocks the vault.
3. Make the few you must memorise into passphrases. Your vault password, your device login, and your email password are the ones to remember — use four or more random words for those.
4. Turn on two-factor authentication. Even a perfect password can be phished. A second factor means a stolen password alone isn't enough to get in.

Common mistakes this generator avoids

• Reusing a "strong" master pattern. Inventing one complex password and changing a digit per site is still a pattern; one leak exposes the rest.
• Predictable randomness. Generating passwords with a weak random function (like a basic Math.random()) can be predictable. This tool uses the browser's cryptographic generator so each character is genuinely unpredictable.
• Ambiguous characters. Confusing pairs like O/0 and l/1 cause typos when a password must be entered by hand; excluding them costs only a little entropy and saves frustration.
• Sending passwords over insecure channels. Don't email or message a generated password in plain text. Share through your password manager's secure sharing or change it after first use.

Does generating a password here leak it?

No. Everything happens locally in your browser using the Web Crypto API — the password is assembled on your device and never transmitted, logged, or stored on our side. You can confirm this by turning off your network connection: the generator still works perfectly, because there is nothing to send.