Developer / IT · Security
Password Generator — Strong Random Passwords
Generate strong, random passwords in your browser with the Web Crypto API — choose the length and character sets, avoid look-alike or hard-to-type symbols, and make several at once. Each password includes every set you pick, and the strength is shown in bits of entropy with an estimated cracking time. Nothing is sent anywhere or stored.
Your inputs
Quick start — try a typical case
Longer is stronger. NIST now asks for at least 15 characters when a password is the only thing protecting an account.
Your result Live
Your Password
Generating in your browser…
16 characters · very strong
- Strength
- Very strong — 103 bits of entropy
- Time to Crack (offline attack, 100 billion guesses a second)
- longer than the age of the universe
- Characters to Choose From
- 87
How this is calculated
Entropy (bits) = length × log₂(characters available) · Average time to crack = 2^(bits − 1) ÷ guesses per second
- Pool
- Number of distinct characters the password can use (e.g. 26 + 26 + 10 + 25 = 87)
- Randomness
- crypto.getRandomValues with rejection sampling, so every character is equally likely
A password's strength comes from how many possibilities an attacker must try. Each extra character multiplies that number by the size of the character pool, so length matters most. This generator uses your browser's cryptographic random-number generator — not Math.random — and makes sure every chosen character type appears.
Assumptions & sources
- Strength assumes the attacker knows the rules used (length and character sets) but not the password.
- Cracking time assumes a fast offline attack on a leaked hash; online attacks are far slower.
- 1Digital Identity Guidelines: Authentication and Authenticator Management (SP 800-63B) — NIST
- 2Crypto.getRandomValues() — MDN Web Docs
Calculator ID DEV-PASSWORD-001 · version 1.0.0
Common questions
How long should a password be?
At least 15 characters if it's the only thing protecting an account (NIST's current guidance); 16–20 random characters is a good default.
Is it safe to generate passwords online?
This page makes them on your device with the Web Crypto API and never sends or stores them. Even so, use a password manager to save them rather than copying them around.