Password Generator

Generate cryptographically random passwords with live entropy and crack-time estimates. Toggle character classes — uppercase, lowercase, digits, symbols — or switch to passphrase mode for memorable EFF-style four-to-seven-word phrases. Bulk mode produces a list. Everything runs in your browser via <code>crypto.getRandomValues</code>.

What “strong” means

A strong password is unpredictable to an attacker who knows everything about how you generated it — except the random bits. The metric that matters is entropy: bits of randomness. Length helps, character classes help, but only if the value was drawn truly randomly. A 20-character password built from the alphabet of common words has less entropy than a 10-character random alphanumeric.

This generator only outputs values from a uniform distribution over the active alphabet. That keeps the entropy calculation honest.

Modes

• Random characters — toggle uppercase, lowercase, digits, symbols. Avoid-similar drops Il1O0. Avoid-ambiguous drops symbols that some shells eat.
• Passphrase — pick word count (4-8), separator, capitalization. Pulls from the EFF long word list (7,776 words ≈ 12.9 bits per word).
• Hex / PIN / numeric — for systems that demand a specific charset.
• Bulk — generate up to 100 at once. Each entry is independent.

How many characters should a password be?

Length is the cheapest way to buy entropy. A rough guide for a random mixed-class password:

If you can’t remember it (because a manager stores it), go long — 20–32 characters costs nothing. If you must type it, a 6-word passphrase hits ~77 bits and is far easier to recall.

Building a password generator in code

The one rule: use a cryptographic RNG.

import secrets, string
alphabet = string.ascii_letters + string.digits + string.punctuation
pw = ''.join(secrets.choice(alphabet) for _ in range(16))     # Python

const cs = "ABC...xyz0-9!@#";
const pw = Array.from(crypto.getRandomValues(new Uint32Array(16)),
                      n => cs[n % cs.length]).join('');        // JavaScript

Never use Python’s random module or JavaScript’s Math.random() for passwords — both are predictable. This tool uses crypto.getRandomValues for exactly this reason.

How it compares to LastPass, Bitwarden, and 1Password

The generators inside password managers are fine — they use secure RNGs too. The difference is scope: a manager generates and stores in one step, while a standalone tool is handy when you need a strong value outside your vault (seeding a server, a CI secret, a throwaway). This generator adds a live entropy read-out and passphrase mode, and it never transmits the result — the same local-only guarantee the reputable managers make.

Common workflows

Spinning up a new service. Generate a 32-char alphanumeric password for the database user, paste into your secret store, never type it again.

Migrating off shared passwords. Bulk-generate one per user, paste into a CSV, import to your IdP. The passwords are written once into the secret manager and never read by a human.

Master password rotation. Use passphrase mode — easier to remember during the few weeks you need it, before muscle memory takes over.

Why it stays in the browser

Any password you generate elsewhere is a password the generator’s host could log. Even when the site is honest, a compromised CDN or a malicious browser extension can steal what passes through. This generator runs only in your browser using the W3C-mandated CSPRNG. Open DevTools → Network → see the silence. Your passwords leave the page only when you copy them.

Last updated: 2026-07-04