Password Generator

When to use this

You're signing up for a new service and you need a password that isn't "Summer2024!" — which, by the way, appears in every major breach database. You need something truly random, something no human would think of, something that can't be guessed from your birthday, pet's name, or favorite band. That's what this generator does.

It's also for the moments when you need a quick API key, a temporary shared secret for a staging environment, or a random token for a one-time link. Any time you need a string that's unpredictable and high-entropy, generating one here is faster than mashing your keyboard and hoping for the best.

Every password is generated using your browser's crypto.getRandomValues() API — the same cryptographic random number generator that underpins TLS, SSH keys, and encryption software. Nothing is sent to any server. The password exists only in your browser until you copy it.

Good to know

Length beats complexity, every time. A 20-character lowercase password (26^20 = ~95 bits of entropy) is harder to crack than a 10-character password using all character types (95^10 = ~66 bits). If a site lets you use long passwords, go long rather than short-and-complex. The math isn't close.

Math.random() is not suitable for passwords. Most programming tutorials generate passwords with Math.random(), which uses a pseudo-random algorithm seeded by a predictable value. An attacker who knows the implementation can reduce the search space dramatically. crypto.getRandomValues() draws from the OS entropy pool — CPU jitter, interrupt timing, hardware noise — and is the only acceptable source for security-sensitive randomness in the browser.

The "exclude ambiguous characters" option exists for a reason. When you have to read a password aloud, type it on a TV remote, or enter it on a device without paste support, confusing 0 with O or 1 with l is infuriating. Excluding these look-alikes costs a tiny amount of entropy but saves real-world headaches.

Power user tip: entropy is what actually matters. A password's strength is measured in bits of entropy: log2(pool_size ^ length). A 16-character password from a 95-character pool has ~105 bits. At 10 billion guesses per second (a well-funded attacker with GPUs), that takes longer than the age of the universe to brute-force. Aim for 80+ bits minimum for anything important.

Quick Reference

Password Config	Pool Size	Entropy (16 chars)	Brute-force Time*
Lowercase only	26	~75 bits	~1.2 million years
Lower + upper	52	~91 bits	~78 billion years
Lower + upper + digits	62	~95 bits	~1.4 trillion years
All printable ASCII	95	~105 bits	~128 quadrillion years
Lowercase only (8 chars)	26	~37 bits	~21 seconds

* At 10 billion guesses/second (modern GPU cluster)