🔐

Secure Password Generator

Create truly random, uncrackable passwords — generated in your browser and never sent anywhere.

Select at least one character type

20
664

Generated with cryptographic randomness in your browser. Nothing is ever transmitted or stored.

A password's strength has almost nothing to do with how clever it looks and almost everything to do with how much randomness went into creating it. This is the point most people miss. Substituting an @ for an a in a dictionary word feels like a security measure, but cracking software has known that trick since the 1990s and tries it automatically. What actually defeats an attacker is entropy — genuine, unpredictable randomness that no pattern can shortcut. This generator uses your browser's cryptographic random number source, the same class of randomness used to secure encrypted connections, and never transmits anything you generate. The password is created on your machine and stays there.

How the generator works

You choose a length and which character sets to include — lowercase, uppercase, digits, symbols — and the generator draws characters using `crypto.getRandomValues()`, the browser's cryptographically secure random source. This matters more than it sounds. The ordinary `Math.random()` function found in most tutorials is predictable enough that an attacker who sees a few outputs can potentially reconstruct the sequence. The cryptographic generator carries no such weakness. Everything runs locally in your browser; no password is ever sent over the network, logged, or stored.

How strength is measured

Entropy (bits) = Length × log₂(Character set size) Character set sizes: lowercase only = 26 → 4.7 bits per character lower + upper = 52 → 5.7 bits per character lower + upper + digits = 62 → 5.95 bits per character all four sets = 94 → 6.55 bits per character Example: 16 chars from all sets = 16 × 6.55 ≈ 105 bits

Entropy measures how many guesses an attacker must make on average, and because it is logarithmic, every additional bit doubles the work required. A 105-bit password has roughly 4 × 10³¹ possible combinations — beyond the reach of any current or foreseeable hardware. The crucial insight is that length contributes more than complexity: a 20-character lowercase password carries about 94 bits, while a 10-character password using all four sets carries only 65. Adding symbols to a short password is far weaker than simply making it longer.

What to know about passwords

  • 1Length beats complexity, consistently. Each extra character multiplies the search space by the size of your character set, while adding symbols only raises the multiplier slightly. Sixteen characters is a reasonable floor for anything that matters; twenty or more for email and banking, since those accounts can reset everything else.
  • 2Never reuse a password across sites. Breaches are routine, and attackers immediately try leaked credentials on every other major service — a technique called credential stuffing. One reused password turns a forum breach into a compromised bank account. This is the single most common way ordinary people get hacked.
  • 3Use a password manager and stop trying to remember them. Human-memorable passwords are, by definition, drawn from a small predictable space. A manager lets every account have a long random password while you remember exactly one strong master passphrase.
  • 4Enable two-factor authentication wherever it is offered. Even a perfect password fails if the site itself is breached or you are phished. An authenticator app is considerably safer than SMS, which is vulnerable to SIM-swapping attacks that are neither rare nor difficult to execute.
  • 5Ignore the old advice about changing passwords every 90 days. Forced rotation causes people to make small predictable edits — Summer2024 becomes Summer2025 — which weakens security rather than improving it. NIST formally dropped this recommendation. Change a password when there is reason to think it was exposed.

Frequently asked questions

Are the passwords generated here safe to use?

Yes. They are generated entirely in your browser using `crypto.getRandomValues()`, the standard cryptographically secure random source, and are never transmitted, logged, or stored anywhere. Nothing leaves your device. If you want to verify this, disconnect from the internet and the generator still works — because there is no server involved at any point.

How long should my password be?

Sixteen characters is a sensible minimum for accounts that matter, and twenty or more for your email and banking, since those can reset everything else. At sixteen characters with mixed sets you are around 105 bits of entropy, which is comfortably beyond brute-force reach. Below twelve characters, modern GPU cracking rigs become a genuine threat rather than a theoretical one.

Is a passphrase better than a random password?

For anything you must memorize, yes. Four or five genuinely random words — chosen by dice or software, not by you — produce strong entropy while remaining rememberable. The catch is that the words must be random. A phrase you invented reflects your own associations, and those patterns are precisely what cracking dictionaries exploit. For anything stored in a password manager, a random string is simpler and stronger.

Does replacing letters with symbols make a password stronger?

Barely. Turning "password" into "p@ssw0rd" adds almost nothing, because every cracking tool applies these substitutions automatically as a first pass. They were common enough by the late 1990s to be standard in attack dictionaries. The base word remains the weakness, and no amount of decoration fixes that. Randomness is the only thing that helps.

How do attackers actually crack passwords?

Rarely by typing guesses into a login form — sites rate-limit that. Instead they steal a database of hashed passwords in a breach and attack it offline, where modern GPUs test billions of candidates per second. They start with leaked password lists, then dictionaries with substitution rules, then patterns like a word plus a year. Truly random passwords have no pattern to exploit, which is why they are the only reliable defense.