Password Generator

About Password Generator

Password Generator is a free, browser-only tool that creates cryptographically secure random passwords. Every password is generated using window.crypto.getRandomValues() — the Web Crypto API built into all modern browsers. Unlike Math.random(), which is a deterministic pseudo-random function unsuitable for security use, the Web Crypto API draws from your operating system's entropy pool (hardware noise, interrupt timing, and similar sources). The result is statistically indistinguishable from true randomness and safe for use in real credentials.

Understanding entropy

Entropy measures how many bits of information an attacker would need to guess your password by exhaustive search. The formula is: entropy (bits) = log₂(charset size) × length. A password 16 characters long drawn from all printable ASCII (94 characters) has log₂(94) × 16 ≈ 104 bits of entropy. An attacker trying 10¹² guesses per second would need, on average, more than 10¹³ years to crack it.

Why character set design matters

Adding symbols to an uppercase-and-lowercase password at length 16 raises entropy from roughly 95 bits (52-char set) to 104 bits (94-char set). The "Exclude similar characters" option removes 0/O/l/1/I from the pool. This costs a few bits of entropy but prevents transcription errors when a password must be read aloud or typed from a printed sheet. For most digital uses — paste from clipboard into a password manager — leave the option off and keep the full character set.

NIST SP 800-63B guidance

NIST's digital identity guidelines recommend prioritising length over complexity rules, allowing all printable ASCII characters, permitting passwords up to at least 64 characters, and not requiring periodic rotation unless compromise is suspected. This tool follows that spirit: the slider defaults to 16 characters and all character classes are enabled so the entropy meter starts in the "Strong" range.

How to use generated passwords safely

Copy the generated password directly into a password manager (Bitwarden, 1Password, KeePass, or similar). Never store passwords in a plain-text file, email, or note-taking app. Do not reuse passwords across services — each account should have a unique credential. If you generate a password for a team secret, share it through a secrets manager, not through Slack or email.

Use cases

• Seed new developer accounts and service credentials with a unique, high-entropy password.
• Generate a shared secret for team access to a staging environment or internal tool.
• Create a strong placeholder for an API key slot while the real key is being provisioned.
• Set a secure local admin password for a new server, workstation, or router.
• Get a throwaway password for a single-use account registration before the real credential is set.