Password Generator

What Makes a Password Strong?

Password strength is measured by entropy — mathematical unpredictability. Entropy is calculated as length × log₂(pool size), where pool size is the number of possible characters. A 16-character password using all character types (uppercase + lowercase + digits + symbols = pool of ~95) has over 104 bits of entropy. At a trillion guesses per second, brute-forcing it would take longer than the age of the universe.

Why Randomness Matters

This generator uses the browser's crypto.getRandomValues() API — a cryptographically secure pseudo-random number generator (CSPRNG) seeded from hardware entropy. This is fundamentally different from Math.random(), which is a fast but predictable pseudo-random function unsuitable for security. Every password generated here is genuinely unpredictable, with no repeating pattern an attacker could exploit.

Character Set Options

Uppercase (A–Z) adds 26 characters to the pool. Lowercase (a–z) adds 26. Numbers (0–9) add 10. Symbols (!@#$...) add approximately 32. Each additional character type multiplies the total possible combinations, increasing the entropy per character. The entropy meter shows bits of entropy in real time as you adjust settings — aim for 80+ bits for personal accounts, 100+ for high-value targets.

Essential Password Hygiene

• Use a password manager (Bitwarden, 1Password) to store unique passwords for every site — humans cannot memorise 50 unique random passwords.
• Never reuse passwords. A breach on one site compromises every account with the same password.
• Enable 2FA on every account that supports it — preferably using an authenticator app, not SMS.
• Length beats complexity: A 20-character lowercase password is stronger than a 10-character password with all character types.

Privacy note: Passwords are generated locally in your browser. Nothing is transmitted to any server.