Password Generator

Password Generator creates cryptographically-random passwords in your browser. Pick a length and the character classes you want, click regenerate (or press it on load) — you get a strong password that never leaves this tab.

How randomness works

Every character is sourced from crypto.getRandomValues() — a CSPRNG built into the browser, designed for cryptographic use. The bytes are mapped onto your selected alphabet with uniform rejection sampling to avoid the bias that naive modulo would introduce.

Strength model

• Entropy bits = length × log₂(alphabet-size). 16 chars of uppercase + lowercase + digits gives ~94 bits — well past the 80-bit threshold considered unbreakable against nation-state attackers.
• Crack time estimates expected time for a 10-billion-guesses-per-second offline rig (think a hardened GPU farm). Below 28 bits = instant. Above 80 bits = forever even with hypothetical quantum on a single password.

Toggles explained

• Uppercase / Lowercase / Numbers / Symbols — character classes you want in the pool.
• Avoid ambiguous — drops 0/o/O, 1/l/I, and other lookalikes. Useful if you’ll be typing the password by hand.

Privacy

The password never makes a network request. The history list (up to 6 most recent) lives in sessionStorage, so it vanishes when you close the tab. Nothing is persisted beyond that.

Tip: passphrase

If the site requires a memorizable password instead of a random one, diceware + 5 words produces ~64 bits of entropy and is far easier to recall.

Common use cases

• Provisioning accounts and services. Create a unique credential for a new database user, staging server, or third-party SaaS seat without reusing anything you already have.
• Rotating after an incident. When a credential may have leaked into logs or a chat message, generate a fresh one immediately rather than inventing a variation of the old one.
• Seed and fixture data. Fill test environments with realistic random strings that will never collide with a real user’s password habits.
• Shared secrets for local development. Produce a session-signing secret or a webhook verification token for a development stack when a full secrets manager would be overkill.
• Dictating credentials. With ambiguous characters excluded, a password can be read over the phone or typed from a printout without confusing 1 with l or O with 0.

How to use

1. A password is generated automatically when the page loads, using the default settings: 16 characters with uppercase, lowercase, numbers, and symbols all enabled.
2. Drag the Length slider anywhere between 4 and 64 characters. Every change regenerates the password and updates the strength bar instantly.
3. Toggle the character set checkboxes to match the rules of the target system. At least one set must stay selected; otherwise a warning banner appears.
4. Enable Avoid ambiguous characters when the password will be read aloud or transcribed by hand.
5. Check the strength bar: it shows the entropy in bits plus an estimated offline crack time.
6. Click Regenerate to roll a new password with the same settings, or Copy to place the current one on your clipboard. The eye icon masks or reveals the output.
7. Expand the history section to see the last six passwords you regenerated in this tab.

Tips and pitfalls

Randomness quality is the whole point of a generator. This tool fills a Uint32Array with crypto.getRandomValues(), the browser’s cryptographically secure PRNG, which is seeded from the operating system’s entropy pool. Generators built on Math.random() are not safe for credentials: its output is predictable from a small number of observed values and its seed space is tiny. Character selection uses the modulo of a 32-bit random value, so for alphabets that are not powers of two there is a theoretical modulo bias, but with 2^32 possible values against an alphabet of at most a few dozen characters the skew per position is far below one part in ten million and irrelevant in practice.

The entropy figure is honest math, not marketing: bits equal length times log2 of the deduplicated alphabet size. That means unchecking a character set or enabling the ambiguous-character filter shrinks the alphabet and lowers the bits per character, which the bar reflects immediately. If a target site forces a short maximum length, compensate by keeping every character set enabled.

Two traps the generator cannot fix for you: reuse and phishing. A 105-bit password reused on a breached site protects nothing, and no entropy defeats a fake login form. Use a unique generated password per account, store it in a password manager, and treat the crack-time readout as an offline worst case, since real login endpoints rate-limit guesses aggressively.

FAQ

Is it safe to generate passwords in a browser?

Yes, provided the generator runs locally and uses a cryptographically secure random source. This tool does both: every character is drawn from crypto.getRandomValues(), the CSPRNG built into your browser, and no network request is ever made. The password exists only in this tab’s memory.

How are the entropy bits and strength rating calculated?

Entropy is computed as length times log2 of the alphabet size, which is the exact Shannon entropy of a uniformly random selection from the enabled character sets. The strength label maps those bits to bands: below 28 bits is very weak, below 36 weak, below 60 fair, below 80 strong, and 80 or more very strong.

What does the Avoid ambiguous characters option do?

It removes visually confusable characters such as I, l, 1, O, 0, o, quotes, and brackets from the alphabet, so a password read aloud or transcribed by hand is less likely to be mistyped. Because the alphabet shrinks, entropy per character drops slightly, so consider adding one or two characters of length to compensate.

What does the crack time estimate actually mean?

It is the expected time for an offline brute-force attack that tries half of the entire keyspace at ten billion guesses per second, roughly what a modern GPU rig achieves against a fast hash. Real online attacks are rate-limited by the server and are far slower, so the estimate is a worst-case floor, not a prediction.

Are the generated passwords stored anywhere?

The collapsible history keeps the last six passwords you explicitly regenerated, and it lives only in sessionStorage, which the browser deletes when the tab is closed. Nothing is written to disk permanently, sent to a server, or synced anywhere.

How long should my password be?

With all four character sets enabled, each character adds about 6.6 bits of entropy. Twelve characters give roughly 79 bits, which is ample for rate-limited online logins, while sixteen characters give about 105 bits and are a comfortable choice for master passwords and other secrets that could face offline cracking.