100% in your browser — files never uploaded
How This Password Generator Works
Every password is generated with crypto.getRandomValues — the browser's cryptographically secure random number generator, the same API used by security software. Unlike Math.random-based generators, the output is unpredictable even to someone who knows the algorithm. Nothing is transmitted: generation happens entirely in your browser, and no password ever leaves your device.
Password Entropy Explained
For character passwords, the estimate is length × log2(character-set size). A 16-character password using all 89 enabled characters is about 104 bits under that random-selection model. The crack-time display is only an estimate at 10 billion guesses per second; real resistance also depends on the target system, hashing method, and whether the password was generated and stored safely.
Passwords vs Passphrases
Passphrase mode selects each word independently and uniformly from this generator's built-in 567-word list. Under that model, each word contributes 9.15 bits: six words estimate to about 55 bits and seven to about 64 bits. A fixed separator and deterministic capitalization add no entropy; the optional randomly placed digit is modelled separately.
Tips for Strong Account Security
Use a unique password per account — reuse is how one breach cascades into many. Aim for 14+ characters or 5+ passphrase words. Enable two-factor authentication wherever offered. And never share passwords over email or chat; use a manager's secure-sharing feature instead.
Math.random() vs crypto.getRandomValues — Why It Matters for Passwords
Math.random(), the default random function in JavaScript, is a fast pseudo-random generator never designed for security — its output can be predicted by an attacker who observes enough samples, which has been demonstrated against real password generators built on it. crypto.getRandomValues draws from the operating system's cryptographically secure entropy source instead, the same class of randomness used in encryption software. This generator uses crypto.getRandomValues exclusively, so the character sequence is unpredictable even to someone who knows exactly how the tool works.
Reading the Entropy Number and Crack-Time Estimate
Entropy in bits is estimated as length times log2 of the enabled character-set size. A 16-character password drawing uniformly from all 89 characters this generator enables reaches about 104 bits under that model. The crack-time estimate assumes an offline attacker guessing 10 billion combinations per second; real outcomes vary with the target system and password-hashing method.
Random-Word Passphrases: Strong Enough to Remember
Passphrase mode trades character-level randomness for word-level randomness. Its built-in list has 567 distinct selectable words, contributing 9.15 bits per independent uniform choice, so six words estimate to 55 bits and seven to 64. A fixed separator and deterministic capitalization add no entropy. This is a modelled estimate, not a guarantee against every attack.
Frequently asked questions
Is this password generator safe to use?
Yes. Passwords are generated with crypto.getRandomValues, a cryptographically secure random source built into your browser. Generation happens 100% on your device — nothing is transmitted, stored, or logged. You can even load the page and disconnect from the internet before generating.
What is a good password length in 2026?
For accounts stored in a password manager, use 16+ random characters with all character types (~100+ bits of entropy). For passwords you must remember, use a passphrase of 6-7 random words instead — it is both stronger and easier to recall than a short complex password.
What is a random-word passphrase?
It is a passphrase built from independently selected random words. This generator selects uniformly from a built-in 567-word list, giving 9.15 bits per word under that model: about 55 bits for six words and 64 bits for seven. Fixed separators add no randomness.
How is the time to crack calculated?
We compute total entropy in bits, then assume an offline attacker guessing 10 billion passwords per second (modern GPU cracking rig). Average crack time is half the keyspace at that rate. Real online attacks are millions of times slower due to rate limiting, so these estimates are deliberately conservative.
Is it safe to type my existing password into the strength checker?
The analysis runs entirely in your browser and nothing is transmitted. That said, as general best practice, avoid typing active high-value passwords (like banking) into any website — use the checker to evaluate password patterns you are considering.