Password Generator

How to Create a Strong Password

A strong password is your first line of defense against unauthorized access. Our password generator uses the Web Crypto API (crypto.getRandomValues) to create cryptographically secure passwords entirely in your browser.

What Makes a Password Strong?

1. Length: At least 12 characters, ideally 16+ — length matters more than complexity
2. Variety: Mix uppercase, lowercase, numbers, and symbols
3. Unpredictability: No dictionary words, names, or personal info
4. Uniqueness: Never reuse passwords across accounts

Password Strength Table

How to Use the Password Generator

1. Set your desired password length using the slider or input field. For most online accounts, a minimum of 16 characters is recommended. For highly sensitive accounts like banking or email, consider 20 or more characters.
2. Select which character types to include: uppercase letters (A-Z), lowercase letters (a-z), numbers (0-9), and special symbols (!@#$%^&*...). Including all four categories maximizes entropy and resistance to brute-force attacks.
3. Optionally exclude ambiguous characters (like l, 1, I, O, 0) to prevent confusion when reading or transcribing passwords manually.
4. Click Generate to create a new password. The built-in strength meter shows the estimated entropy in bits and a qualitative rating (weak, fair, good, strong). Use Copy to copy the password to your clipboard.
5. Paste the generated password into your account registration or password manager. Never reuse the same password across multiple accounts — use a password manager to store unique passwords for each service.

Understanding Password Security

Password strength is determined by two factors: length and character diversity. Each additional character multiplies the search space by the number of possible characters, so a 16-character password using all four character types (uppercase, lowercase, digits, symbols — approximately 94 possible characters each) has 94^16 ≈ 2^105 possible combinations. This translates to about 105 bits of entropy, which is computationally infeasible to crack even with specialized hardware. By comparison, a common 8-character password using only lowercase letters has just 26^8 ≈ 2^37 combinations — crackable in seconds on a modern GPU.

Modern password cracking relies on dictionary attacks, rainbow tables, and GPU-accelerated brute force. Tools like Hashcat can test billions of password candidates per second against leaked password hashes. This is why predictable patterns — substituting @ for a, appending numbers or !, using names, dates, or common words — provide negligible security. The Have I Been Pwned database contains over 12 billion leaked passwords, and attackers use these datasets to prioritize guesses. A randomly generated password of sufficient length sidesteps all dictionary-based attacks because it has no predictable pattern.

This generator uses the Web Crypto API's crypto.getRandomValues() function to draw cryptographically secure random numbers from the operating system's entropy pool. Unlike Math.random(), which is a simple pseudorandom generator and theoretically predictable, crypto.getRandomValues() is suitable for security-sensitive operations. The generator also enforces character type inclusion guarantees — if you select uppercase, lowercase, numbers, and symbols, the output will always contain at least one character from each category. All generation happens client-side, meaning your passwords are never transmitted over the network or stored on any server.