Password Generator

About this password generator

Passwords are generated in your browser using the Web Crypto API's getRandomValues, never Math.random. Nothing is transmitted, and nothing is stored — reload the page and these are gone forever.

Why the random source matters

Math.random is not cryptographically secure: its output is predictable from enough observed values, which is fine for shuffling a playlist and disqualifying for a password. Just as important, this tool picks characters by rejection sampling rather than taking a random byte modulo the alphabet size. Plain byte % 62 makes the first eight characters of the alphabet roughly 5% more likely than the rest — a small, invisible bias that quietly shrinks the search space an attacker has to cover.

What the entropy figure means

Entropy in bits measures how many guesses an attacker needs: each extra bit doubles it. Around 45 bits is weak against a determined offline attack, 65 is respectable, and past 90 the number is so far beyond brute force that adding more length buys nothing in practice. Length matters far more than exotic symbols — a 24-character lowercase password has more entropy than a 12-character one using every symbol on the keyboard.

One honest caveat: the figure shown is for the unconstrained generator. Requiring at least one character from every set very slightly reduces true entropy, because it rules out otherwise-valid combinations. The effect is negligible at normal lengths, but it is a reduction — not the increase that password-strength meters often imply.

Use a password manager

A generated password is only as good as where it ends up. Long random strings are impossible to remember by design, so they belong in a password manager, with one strong passphrase protecting the vault. Reusing even an excellent password across sites undoes all of this the first time one of them is breached.