Password Generator
Generate strong random passwords with configurable character sets and strength scoring.
What this tool does
A strong password is the first line of defense for any online account, yet most users still rely on predictable patterns and reuse the same password across multiple services. This generator creates cryptographically random passwords using your browser's secure random number generator, with configurable length, character classes, and entropy estimation.
The strength of a password is measured in bits of entropy, which depends on both the length and the size of the character set. A password with 60+ bits of entropy is considered strong against modern offline attacks, while passwords below 40 bits can be cracked in seconds. The strength meter in this tool gives you immediate feedback on whether your generated password meets current security recommendations.
Usage Example
// 16 characters, all classes: 103 bits of entropy
k8#TmP9$nQ2vR@xL
// 24 characters, all classes: 155 bits (excellent)
K7#mP9$nQ2vR@xL4&wY8!eF3z
// Passphrase style (diceware-like)
correct-horse-battery-staple-42
// ~50 bits if 4 words from 7776-word listCommon Edge Cases
- Very short passwords (under 8 characters) are vulnerable to brute force attacks regardless of character set complexity.
- Predictable patterns like qwerty, 123456, or P@ssw0rd are in every cracker's wordlist and provide minimal security despite meeting complexity rules.
- Mandatory character rotation policies (e.g., change every 30 days) often lead to predictable variations (Spring2024!, Summer2024!) that are easier to crack than a single strong password.
- Using the same password across multiple services means a single breach compromises all your accounts. Use a password manager to generate and store unique passwords for each service.
- The maximum entropy for printable ASCII is about 6.55 bits per character, so a 16-character password has at most ~105 bits of entropy.
FAQ
- Is this generator cryptographically secure?
- Yes. The randomness comes from the browser's crypto.getRandomValues() API, which is suitable for cryptographic use. The generated passwords are not stored or transmitted anywhere.
- How long should my password be?
- NIST recommends at least 8 characters, but 14+ characters is recommended for accounts that support it. Longer is always better; passphrases of 4+ random words are also excellent.
- Should I use a password manager?
- Yes. Password managers generate, store, and autofill unique strong passwords for every site. You only need to remember one strong master password to unlock the manager.