Password Generator
Random passwords with an entropy and crack-time readout.
About Password Generator
Password Generator creates random passwords using the browser’s cryptographic random number generator, and shows you the entropy in bits alongside an estimate of how long the password would survive an offline cracking attack. Length matters far more than symbol soup: a 20-character password of lowercase letters beats an 8-character one full of punctuation. The password is generated in your browser and never transmitted or logged.
How to use it
- Set the length — 16 or more for anything that matters, 20+ for important accounts.
- Choose which character sets to include. Leave "avoid look-alikes" on if you may have to read the password aloud or type it by hand.
- Copy it straight into your password manager. Generate a new one for every account.
Questions
How long should a password be?
At least 16 characters for ordinary accounts, 20 or more for email, banking and your password manager’s master password. Every extra character multiplies the work an attacker must do.
Is generating a password in a browser safe?
It uses crypto.getRandomValues, the same cryptographically secure source used for encryption keys — not Math.random, which is predictable. Nothing is sent over the network. That said, generating passwords directly inside your password manager is the better habit.
What does entropy mean here?
Bits of entropy measure how many guesses an attacker needs. Each extra bit doubles it. Under 50 bits is weak, 80 is solid, over 100 is beyond reach of any realistic offline attack.
Why can I turn off look-alike characters?
Because l, 1, I, O and 0 are easily confused when a password must be read from a screen or written down. Removing them costs a small amount of entropy, which extra length more than repays.
Password Generator is free and runs entirely in your browser. No account, no upload, no watermark, no limit on use.