Password Generator — Strong Passwords & Passphrases
Cryptographically secure passwords and passphrases — generated in your browser, never uploaded.
100% in your browser — files never uploaded
How This Password Generator Works
Every password is generated with crypto.getRandomValues — the browser's cryptographically secure random number generator, the same API used by security software. Unlike Math.random-based generators, the output is unpredictable even to someone who knows the algorithm. Nothing is transmitted: generation happens entirely in your browser, and no password ever leaves your device.
Password Entropy Explained
Entropy measures password strength in bits: entropy = length × log2(charset size). A 16-character password using letters, numbers, and symbols (94 characters) gives roughly 105 bits — far beyond brute-force reach. The meter estimates crack time at 10 billion guesses per second, a realistic rate for modern GPU attacks. Anything above 80 bits is effectively uncrackable today.
Passwords vs Passphrases
A diceware passphrase strings together random words from the EFF wordlist — 'correct horse battery staple' style. Six random words give about 77 bits of entropy while staying memorable. Use passphrases for master passwords you must remember, and random character passwords for everything stored in a password manager.
Tips for Strong Account Security
Use a unique password per account — reuse is how one breach cascades into many. Aim for 14+ characters or 5+ passphrase words. Enable two-factor authentication wherever offered. And never share passwords over email or chat; use a manager's secure-sharing feature instead.
Math.random() vs crypto.getRandomValues — Why It Matters for Passwords
Math.random(), the default random function in JavaScript, is a fast pseudo-random generator never designed for security — its output can be predicted by an attacker who observes enough samples, which has been demonstrated against real password generators built on it. crypto.getRandomValues draws from the operating system's cryptographically secure entropy source instead, the same class of randomness used in encryption software. This generator uses crypto.getRandomValues exclusively, so the character sequence is unpredictable even to someone who knows exactly how the tool works.
Reading the Entropy Number and Crack-Time Estimate
Entropy in bits is calculated as length times log2 of the character set size, and it's the single number that best predicts resistance to brute-force guessing. A 16-character password drawing from all 94 printable characters reaches roughly 105 bits, well past any realistic attack budget. The crack-time estimate assumes an offline attacker guessing 10 billion combinations per second on modern GPU hardware — a deliberately aggressive assumption, since real-world online attacks are slowed enormously by rate limiting on the target service.
Diceware Passphrases: Strong Enough to Remember
A diceware passphrase — several words picked at random from a standard wordlist, like the EFF's — trades character-level randomness for word-level randomness, and still adds up to real entropy: roughly 9 bits per word, so a six-word phrase reaches about 77 bits. The advantage over a random character string is memorability, which matters specifically for the handful of passwords a person must type from memory, like a device unlock or a password manager's master password — everything else belongs in a manager as a fully random string.
Frequently asked questions
Is this password generator safe to use?
Yes. Passwords are generated with crypto.getRandomValues, a cryptographically secure random source built into your browser. Generation happens 100% on your device — nothing is transmitted, stored, or logged. You can even load the page and disconnect from the internet before generating.
What is a good password length in 2026?
For accounts stored in a password manager, use 16+ random characters with all character types (~100+ bits of entropy). For passwords you must remember, use a passphrase of 6-7 random words instead — it is both stronger and easier to recall than a short complex password.
What is a diceware passphrase?
A passphrase built from randomly selected dictionary words, like correct-horse-battery-staple. Each random word adds about 9 bits of entropy, so 7 words gives roughly 64 bits — strong, yet far easier to type and remember than random symbols.
How is the time to crack calculated?
We compute total entropy in bits, then assume an offline attacker guessing 10 billion passwords per second (modern GPU cracking rig). Average crack time is half the keyspace at that rate. Real online attacks are millions of times slower due to rate limiting, so these estimates are deliberately conservative.
Is it safe to type my existing password into the strength checker?
The analysis runs entirely in your browser and nothing is transmitted. That said, as general best practice, avoid typing active high-value passwords (like banking) into any website — use the checker to evaluate password patterns you are considering.