Password Generator
Generate strong, random passwords with a custom length and character mix.
Password Length
Character Types
Options
Select at least one character type
0 bits of entropy · would take about Instantly to crack by brute force
How this password generator works
Each character is picked using your browser's cryptographically secure random number generator (crypto.getRandomValues), not the predictable pseudo-random Math.random() that some generators still use under the hood. Nothing is sent to a server — the password is generated and shown entirely in your browser.
Why length beats extra character types
An 8-character password using only lowercase letters has about 37.6 bits of entropy. Adding uppercase, numbers and symbols to that same 8-character password only brings it to about 52.4 bits — a meaningful jump, but nowhere near what simply extending the length does. A 16-character password using all four character types reaches roughly 104.9 bits, since each additional character multiplies the total number of possible combinations rather than adding to it.
What the crack-time estimate actually assumes
The estimate on this page assumes an offline attacker guessing at 10 billion attempts per second — a realistic figure for modern hardware attacking a leaked password hash — and calculates the average case as half the total keyspace. Real-world cracking speed varies a lot depending on how the password was hashed (a well-designed hash like bcrypt or Argon2 is drastically slower to brute-force than an unsalted MD5 hash), so treat the number as illustrative of relative strength, not a literal guarantee.
After generating a password
Store it in a password manager rather than reusing it across sites — even a very strong password stops protecting you the moment it's reused somewhere that later gets breached, since credential-stuffing attacks specifically try leaked username/password pairs against other sites.
Frequently Asked Questions
Is this password generator actually secure?
Yes — it uses your browser's cryptographically secure random number generator (crypto.getRandomValues), the same class of randomness used for security-sensitive applications, rather than a predictable pseudo-random function like Math.random().
Are generated passwords sent to a server?
No — password generation happens entirely in your browser, and nothing you generate is transmitted or logged anywhere.
How long should my password be?
Longer is better — each additional character multiplies the number of possible combinations, so length generally does more for security than adding extra character types to a short password. 16+ characters is a reasonable modern baseline.
Does adding symbols matter more than adding length?
Length wins. An 8-character password of lowercase letters only has about 37.6 bits of entropy; adding uppercase, numbers and symbols to those same 8 characters brings it to roughly 52.4 bits. Simply extending to 16 characters with all four types reaches about 104.9 bits — extra length compounds, extra character types add a smaller one-time boost.
How is the crack-time estimate calculated?
It assumes an offline attacker trying 10 billion guesses per second against a leaked password hash, averaging over half the total keyspace. It's a useful way to compare relative strength between passwords, not a literal promise — actual cracking speed depends heavily on how the site hashed the password in the first place.
Should I exclude ambiguous characters like l, I, 1, O and 0?
Only if you'll ever need to type the password by hand — those characters look alike in many fonts and are a common source of manual entry errors. If you're copying and pasting from a password manager, there's no downside to leaving them in, and doing so slightly increases the character set.