Password Generator
Create secure, random passwords with customizable length and character sets.
Why generate here?
We use the crypto.getRandomValues() API, which provides cryptographically strong random values. Your password never leaves your browser.
Pro Tip
For maximum security, use at least 16 characters with a mix of all four character types. Avoid using real words or personal info.
How this password generator works
Each character is drawn from the pools you enable using crypto.getRandomValues(), the browser's cryptographically secure random number source. Unlike Math.random(), it is not predictable from previously observed output, so a generated password cannot be reconstructed by an attacker who knows when it was created. Generation happens locally: no password is transmitted to a server, written to storage or included in analytics.
Understanding password strength
Strength is measured in entropy bits, calculated as length multiplied by the base-2 logarithm of the character pool size. A 12-character password using lowercase letters only carries about 56 bits, while the same length across all four pools carries roughly 79 bits. Adding length raises entropy far faster than adding exotic symbols, which is why a 20-character passphrase usually beats a short string of punctuation. Anything above 80 bits is considered impractical to brute force with current hardware.
Practical guidance
Use a unique password for every account and store them in a password manager rather than reusing a memorable pattern. Enable multi-factor authentication wherever it is offered — it defends the account even if a password is leaked in a third-party breach. Rotate credentials only when you suspect exposure; forced periodic rotation tends to push people toward weaker, predictable variations.