Password Generator

You need a strong password for a new signup, and this Password Generator draws one locally in your browser with crypto.getRandomValues(). A 16-character password built from all four character sets carries roughly 103 bits of entropy, which an offline attacker would take billions of years to brute-force at current speeds.

Generate a password in four steps

The tool sits right below this section. Drag the password length slider to your target length; it starts at 16 characters and moves between 8 and 64. Keep the four character set boxes ticked to mix uppercase letters, lowercase letters, numbers, and symbols. Click Generate password to draw a fresh value, then press the copy button beside the result to place it on your clipboard.

Example: with a length of 16 and all sets enabled, one run produced kF7#mQ2@vL9$wR4!. Moving the slider to 20 and generating again returned 9tR!xV5?bH2&kL8#mN4$. A third click at the same settings gave a completely different string, because every character is picked independently.

Character sets and pool size

Each enabled set adds characters to the pool the generator draws from: 26 uppercase letters, 26 lowercase letters, 10 digits, and 26 symbols. All four together form an 88-character pool. Tick only uppercase and digits and the pool drops to 36, which changes the strength math even when the length stays the same.

Turn on Avoid ambiguous characters to strip out 0, O, 1, l, and I, the five look-alikes that get mistyped on phone screens and printed labels. The generator still guarantees at least one character from every selected set, so a result never ends up missing the digits or symbols a site requires.

Reading the strength report

The result panel shows three numbers for each password: entropy in bits, pool size, and an estimated crack time at 10 billion guesses per second. Entropy is length multiplied by log2 of the pool size, and the strength label follows the usual bands: below 40 bits is Weak, 40-59 is Fair, 60-79 is Strong, and 80 or more is Very strong.

Run through three examples. A 6-digit PIN has about 20 bits of entropy and cracks instantly, so it is only useful for a passcode, never a password. An 8-character lowercase-only value like kqfdvxnm lands near 38 bits and takes around 21 seconds at the same guessing speed. A 12-character alphanumeric string from the 62-letter-digit pool reaches about 71 bits, which is roughly 9,000 years.

Why local randomness matters

The generator reads from crypto.getRandomValues, the browser API backed by the operating system secure random source on every device. It uses rejection sampling so each character is equally likely, with no modulo bias. Nothing generated here is sent to a server, stored in a log, or visible to the page owner, which is the same promise Bitwarden and NordPass make for their own client-side generators.

Keep the result private

Do not paste a generated password into an online strength checker or a breach lookup. Those pages receive the value you type, and the whole point of generating locally is that the secret stays on your device. The strength figures in this tool are computed from the settings you chose, so they are accurate without any network round trip.

When a passphrase beats a password

Sites that accept spaces or hyphens can use a passphrase instead. Five random words drawn from a 7,776-word list contribute about 64 bits of entropy and are far easier to type on a TV remote or phone. A character password stays the better choice when a service caps length or bans spaces, since a 20-character mixed string at 129 bits leaves no room for a dictionary attack to begin.