Strong Random Password Generator

How this generator works

Each password is assembled from crypto.getRandomValues(), the cryptographically secure random number generator built into every modern browser. It is the same source used to create encryption keys, and it is deliberately different from Math.random(), whose output can be predicted once an attacker has seen enough of it.

Two details matter beyond the source of randomness. First, the character index is drawn without modulo bias, so every character in your selected pool is exactly as likely as any other rather than the first few being slightly favoured. Second, one character is seeded from each type you tick and the result is then shuffled, so a password always satisfies the rules you asked for without those characters landing predictably at the front.

Reading the strength meter

The meter shows entropy in bits, calculated as the password length multiplied by the base-2 logarithm of the pool size. Each additional bit doubles the number of guesses an attacker needs.

• Under 40 bits — falls to an offline attack in minutes.
• 60 to 80 bits — adequate for low-value accounts.
• 80 to 110 bits — the sensible target for anything that matters.
• Over 110 bits — beyond any realistic brute-force attack for the foreseeable future.

One caveat worth understanding: this number describes the process that made the password, not the string itself. A password of P@ssw0rd123! looks like twelve mixed characters, but a human chose it from a tiny mental pool of predictable patterns, so its real entropy is a fraction of what the arithmetic suggests. The figure here is honest precisely because the characters were drawn at random.

Length beats complexity

The old advice to force an uppercase letter, a digit and a symbol into every password produced strings that were hard for people to remember and easy for computers to guess, because everyone applied the rules the same predictable way. Modern guidance, including from NIST, points the other way: prioritise length, and drop mandatory composition rules.

In practical terms, a 20-character password made of lowercase letters alone is stronger than a 10-character password using every character type. If you can only change one setting here, change the length.

Where to keep passwords like this

A random 20-character string is not memorable, and it is not meant to be. Use a password manager — Bitwarden, 1Password, KeePassXC or the one built into your browser — and let it store a different random password for every site. You then memorise exactly one strong master password.

That single change removes the real-world risk that matters most. Credential stuffing works because people reuse passwords: one breached forum gives attackers a working login for an email account. Unique passwords per site contain a breach to the one site that leaked.

Is it safe to use a password generator on a website?

It depends entirely on where the password is created. If a site generates it on its own server, that server has seen your password, and you have no way to verify what it did with it.

This page generates the password in your browser. Nothing is transmitted, logged or stored, and you can verify that claim yourself: open your browser developer tools, switch to the network tab, and generate a few passwords. No request leaves the page. The tool also keeps working with your connection switched off entirely.