Password Generator
Generate cryptographically secure passwords. Everything runs in your browser — nothing is sent to any server.
Why You Need Strong Passwords
Weak passwords are the number one cause of security breaches. Attackers use brute-force attacks, dictionary attacks, and credential stuffing to compromise accounts. A strong, randomly generated password is your best defense against these threats.
Password Security Best Practices
- Use at least 16 characters. Every additional character exponentially increases the time required for a brute-force attack. A 16-character password with mixed character types would take centuries to crack.
- Mix character types. Combine uppercase, lowercase, numbers, and symbols. This maximizes the entropy (randomness) of your password.
- Never reuse passwords. Use a unique password for every account. A breach on one site should not compromise your other accounts.
- Use a password manager. Tools like Bitwarden, 1Password, or KeePass securely store your passwords so you only need to remember one master password.
- Enable two-factor authentication (2FA). Even a strong password can be phished. 2FA adds a second layer that protects you when your password is compromised.
- Avoid personal information. Never use birthdays, pet names, or common words. Attackers use social engineering to guess these.
Understanding Password Entropy
Password entropy measures the unpredictability of a password in bits. Higher entropy means a harder-to-crack password. Entropy is calculated as: E = L × log2(R), where L is the password length and R is the size of the character pool.
| Entropy (bits) | Strength | Crack Time (10B guesses/sec) |
|---|---|---|
| 28 | Very weak | Instant |
| 36 | Weak | ~7 seconds |
| 60 | Strong | ~36 years |
| 80 | Very strong | ~38 million years |
| 128 | Overkill | ~1018 years |
How This Tool Works
This password generator uses crypto.getRandomValues(), the Web Crypto API's cryptographically secure random number generator. Unlike Math.random(), which uses a predictable pseudo-random algorithm, crypto.getRandomValues() draws from the operating system's entropy source, making the output truly unpredictable. Everything runs 100% in your browser — no passwords are ever transmitted over the network.