Password Generator
Create strong, random passwords entirely in your browser. Nothing is sent to a server, and every password is generated with the Web Crypto API.
Password
—
16
Strength
Very strong
Entropy
103 bits
Crack time (fast hash)
Longer than the age of the universe
How it works
Entropy = length × log2(pool size) bits. Keyspace = pool size ^ length. Average crack time = keyspace ÷ (2 × 100 billion guesses per second).
Worked example
A 16-character password from a 94-character pool has about 105 bits of entropy; at 100 billion guesses per second it takes about 7.5 trillion years to crack on average.
Reference
Modeled on the SecurityGen password generator, which creates passwords in your browser with crypto.getRandomValues and sends nothing to a server.
Frequently asked questions
Is this password generator safe to use?
Yes. Passwords are created in your browser with crypto.getRandomValues, the operating system's cryptographically secure random number generator used for TLS keys. Nothing you generate is sent to a server, and the page keeps working if you disconnect from the internet.
How long should a password be?
For a password manager, 16 or more characters from the full set gives about 105 bits of entropy, out of reach of any known attack. NIST asks services to accept at least 15 characters; 20 or more costs you nothing and adds significant strength.
Do I need symbols in my password?
Not if it is long and random. Symbols add less than one bit of entropy per character compared with letters and digits. Turn symbols off when a site rejects them and add three or four characters of length instead.
What does "avoid look-alikes" do?
It removes characters that are easy to confuse when reading or typing by hand, such as l, 1, I, O, 0 and o. The pool gets slightly smaller, so the tool shows the entropy change live.
Why guarantee one character of each type?
Many sites reject passwords missing a character class. With this option on, the generator draws fully random passwords and discards any that miss a selected class, so every character stays uniformly random while meeting site rules.
Do you store the passwords I generate?
No. Generated passwords exist only in the page's memory while the tab is open. The site remembers your settings in local storage, never the passwords themselves, and you can clear that anytime.
How is entropy calculated?
Entropy equals length times log2 of pool size in bits. A 16-character password from a 94-character pool has about 105 bits. More length multiplies the keyspace, while a bigger pool only nudges it, which is why length matters most.