Password Generator

The Password Generator creates strong, random, cryptographically secure passwords that resist brute-force attacks, dictionary attacks, and credential stuffing. With a single click you get a unique password that meets the length and complexity requirements of any modern account — web apps, cloud consoles, email, databases, SSH keys, Wi-Fi routers, or disk encryption. Every password is generated locally in your browser using the Web Crypto API (crypto.getRandomValues), the same cryptographic random source used by TLS and modern browsers for key generation. Your passwords never touch our servers.

Password reuse is the single biggest cause of account takeovers. When one site gets breached, attackers try the leaked credentials on every other service. A unique, random password per account — stored in a reputable password manager like 1Password, Bitwarden, or your browser's built-in manager — eliminates this entire class of attacks. Use this tool to generate one password at a time, or bulk-generate 100 passwords at once for batch provisioning. Customize length (8 to 128 characters), character classes (uppercase, lowercase, digits, symbols), exclude ambiguous characters (0/O, 1/l/I), or switch to passphrase mode for memorable human-friendly passwords.

This tool uses the Web Crypto API (window.crypto.getRandomValues()) — a cryptographically secure pseudo-random number generator (CSPRNG) available in all modern browsers. It is seeded by the operating system's entropy pool (hardware random number generators, timing jitter, user input) and is suitable for cryptographic purposes including password generation, key generation, and session token creation. It is not the same as Math.random(), which is fast but predictable and must never be used for security.

Password entropy is the measure of unpredictability, expressed in bits. Entropy is calculated as log2(alphabet_size ^ length). Examples:

- 8 characters, lowercase only (26 alphabet): ~37.6 bits — weak, crackable in hours
- 12 characters, mixed case + digits (62 alphabet): ~71.4 bits — strong for most accounts
- 16 characters, all printable ASCII (94 alphabet): ~105 bits — strong for high-value accounts
- 20 characters, all printable ASCII: ~131 bits — resistant to nation-state attacks
- 6-word Diceware passphrase (~7776 word list): ~77.5 bits — strong, memorable

NIST SP 800-63B password guidelines (current): Minimum 8 characters, allow up to 64+ characters, permit all printable characters including spaces, do not require forced complexity rules, do not force periodic rotation, check against breach databases (Have I Been Pwned), use password managers for storage. The old rules (force mixed case, symbols, rotate every 90 days) are explicitly discouraged by NIST as they push users toward predictable patterns.

Passphrase mode: Uses a list of common English words (or EFF's large Diceware list of 7,776 words). A 6-word passphrase like correct-horse-battery-staple-river-quartz has ~77 bits of entropy — stronger than most 10-character random passwords while being far easier to remember. Recommended by XKCD and NIST.

Random password vs passphrase: Random passwords like xK7#nP9$wE3@vR2m are shorter and higher entropy per character, but hard to type and remember. Passphrases like correct-horse-battery-staple are longer but memorable. For password-manager-stored passwords, random is better. For master passwords you must memorize, passphrases win. Both can be equally strong with enough length.

Password generator vs password manager: A generator makes random passwords; a manager stores them securely. You need both. Use this generator (or your password manager's built-in generator) to create passwords, then store them in 1Password, Bitwarden, KeePassXC, iCloud Keychain, or your browser's sync. Never manually remember more than a handful of passwords.

Password vs passkey: Passkeys (WebAuthn) are the future: cryptographic keys stored in your device or password manager that replace passwords entirely. Supported by Apple, Google, Microsoft, GitHub, and growing. Where passkeys are available, use them. Passwords remain necessary for legacy services.

Password vs SSH key: SSH keys are public/private key pairs — no password to guess, protected by a passphrase on the private key. Used for server access, Git pushes, and automation. Passwords still exist for many services, but prefer key-based authentication wherever possible.

Password length vs complexity: Length beats complexity. A 20-character lowercase-only password (~94 bits entropy) is much stronger than an 8-character password with all character classes (~52 bits). When a service allows it, prefer longer passwords even if they're all lowercase letters over shorter passwords with forced symbols.