Mode
Est. Entropy
Strength
Character Sets
Est. Entropy
Strength
Separator
How Many
Quick Presets
No charset selected — enable at least one character set above.
Session only — cleared when you close the tab
History is empty.
What Makes a Strong Password?
The single biggest factor in password strength is length. Every additional character multiplies the number of possible combinations by the charset size. A 20-character lowercase password is dramatically harder to crack than a 10-character mixed-case one, even though the shorter one looks more complex.
Character diversity adds entropy — mixing uppercase, lowercase, digits, and symbols increases the size of the pool each position draws from. But diversity without length still fails. A1! is three characters no matter how diverse.
Unpredictability matters more than complexity rules. Patterns like P@ssw0rd! follow well-known substitution rules and are trivially cracked by modern dictionary attacks. True randomness from a cryptographic source (like this generator) is the only reliable defence.
This generator uses window.crypto.getRandomValues — the browser's cryptographically secure pseudorandom number generator (CSPRNG). Math.random() is never called.
Password Entropy Reference
Entropy measures unpredictability in bits. Formula: bits = length × log₂(charset size). Higher is better. Security researchers generally recommend ≥ 80 bits for high-value accounts.
| Character Set | Pool Size | Bits / char | 16-char total | 20-char total |
|---|---|---|---|---|
| Digits only (0–9) | 10 | 3.3 | 53 | 66 |
| Lowercase (a–z) | 26 | 4.7 | 75 | 94 |
| Mixed case (a–z, A–Z) | 52 | 5.7 | 91 | 114 |
| Alphanumeric | 62 | 5.95 | 95 | 119 |
| Alphanumeric + symbols | 95 | 6.57 | 105 | 131 |
Colours indicate strength tier: Weak · Fair · Good · Strong · Very Strong
Passphrases vs Random Passwords
A passphrase like marble-cabin-storm-eagle-noble is both memorable and strong. With a 512-word list and 5 words, entropy is 5 × log₂(512) = 45 bits. With 6 words: 54 bits. With 7 words: 63 bits.
Passphrases excel where humans must type or remember credentials — SSH keys, full-disk encryption, or master passwords. A random character password of similar entropy is more compact but harder to type without a password manager.
Use random character passwords everywhere a password manager fills them in automatically. Use passphrases for the master password itself, full-disk encryption, and any credential you need to type regularly.
Frequently Asked Questions
Is this password generator safe to use?
Yes. All generation happens entirely in your browser using window.crypto.getRandomValues — the Web Crypto API's CSPRNG. No password data is transmitted to any server. You can verify this by opening browser DevTools and checking the Network tab — there are no requests when you click Generate.
What is entropy in a password?
Entropy, measured in bits, quantifies how unpredictable a password is. A password with N bits of entropy requires an attacker to try 2ᴺ combinations on average to guess it. Each additional bit doubles the search space. 80 bits is generally considered very strong against offline attacks by current hardware.
How often should I change my password?
NIST SP 800-63B no longer recommends periodic password rotation unless a compromise is suspected. Mandatory rotation leads to weaker passwords (Password1 → Password2). Instead, use a unique, strong random password for each service and change it only after a confirmed or suspected breach.
What is a passphrase and is it as secure as a random password?
A passphrase is a sequence of random words. Its security depends on the size of the word list and the number of words — not on the words themselves. A 6-word passphrase from a 512-word list has 54 bits of entropy, which is comparable to a 9-character fully random alphanumeric password. With 7+ words it exceeds most random character passwords in practical security.
Does the site store my password?
No. Generation is entirely client-side — JavaScript runs in your browser tab and the password never leaves your device. Session history is stored only in your browser's memory (Alpine.js state) and disappears when you close the tab. Nothing is written to localStorage, cookies, or any server.
How long should my password be?
It depends on the use case. For web accounts managed by a password manager: 16–20 characters with full charset gives 100+ bits of entropy and is uncrackable for the foreseeable future. For master passwords you type manually: a 6-word passphrase achieves the same entropy while remaining typeable. NIST recommends a minimum of 8 characters for human-chosen passwords, but generated passwords should be longer.
Further Reading
Authoritative references on password security, randomness, and authentication best practices.
NIST SP 800-63B — Digital Identity Guidelines
The US government standard for authentication and password policies, including guidance on length requirements, composition rules, and breach checking.
OWASP Authentication Cheat Sheet
Developer-focused guidance on password storage, hashing, and authentication defences from the Open Web Application Security Project.
MDN Web Docs — Crypto.getRandomValues()
Full reference for the Web Crypto API method used by this generator. Explains the CSPRNG, buffer types, and browser support.
Have I Been Pwned
Check whether your email or a known password has appeared in a data breach. Reinforces why unique, generated passwords matter for every account.