Password generator that works offline
Strong, secure passwords generated instantly.
Character set
This generates passwords using crypto.getRandomValues(), the browser's cryptographically secure random number generator, entirely in memory. Nothing is transmitted, logged or stored — refresh the page and the password is gone. The distinction from Math.random() matters: Math.random() is a fast pseudo-random generator that is explicitly not suitable for anything security-related, and a password generated from it is predictable given enough observed output. Strength is measured in entropy bits, calculated as length × log₂(character set size). A 16-character password drawn from all 94 printable ASCII characters carries about 104 bits, which is far beyond brute-force reach. Length contributes more than complexity: a 20-character lowercase-only password beats a 10-character password using every symbol class. The generator cannot protect a password after you have it — reuse across sites remains the single largest practical risk, which is what a password manager exists to solve.
About the Password Generator
Generate strong, cryptographically-random passwords that are virtually impossible to guess. Our password generator uses the browser's secure Web Crypto API, so every character is truly random — and nothing is ever sent over the network.
How to use the Password Generator
- 01Choose your desired password length using the slider.
- 02Pick the character types to include: uppercase, lowercase, numbers, and symbols.
- 03Click “Generate” to create a new password instantly.
- 04Use the “Copy” button to safely copy your password to the clipboard.
Why use our Password Generator
- 01
Cryptographically secure
Backed by crypto.getRandomValues() for true randomness.
- 02
Strength meter
Visual feedback based on entropy so you know exactly how strong your password is.
- 03
Fully customizable
Length from 4 to 64 characters, with full control over the character set.
- 04
Never stored
Passwords are generated in memory only and never logged or transmitted.
What actually makes a password strong?
Password strength is measured in entropy — bits of genuine unpredictability — and the arithmetic is simple. Entropy equals the length multiplied by the base-two logarithm of the character set size. A 12-character password drawn from the 95 printable ASCII characters carries about 79 bits; extending it to 16 characters gives about 105 bits; 20 characters gives about 131. The critical insight is that length contributes linearly while character-set size contributes only logarithmically, which means adding four characters helps far more than adding symbols to a short password. A 20-character lowercase-only password has more entropy than a 10-character password using every symbol on the keyboard. This is why modern guidance, including NIST's, has moved away from mandatory complexity rules toward length: composition requirements push people toward predictable substitutions like P@ssw0rd1, which humans find memorable and attackers model easily, while the entropy gain is small.
Why in-browser generation is safe and server generation is not
A password generated on a server has, by definition, existed somewhere you do not control. It travelled over a network, it was held in that server's memory, and it may have been written to a log, a crash dump or a cache without anyone intending it. Even where the operator is entirely trustworthy, the attack surface exists. Generating in the browser removes it: the value is produced by your own device's entropy source, exists only in the tab's memory, and is discarded when the page is closed. crypto.getRandomValues() draws from the operating system's cryptographically secure entropy pool — the same source that seeds TLS keys — rather than from a deterministic algorithm. You can confirm nothing is sent by opening the Network tab in developer tools while generating, or by disconnecting from the internet after the page loads and generating anyway. The one thing browser generation cannot protect against is your own machine being compromised, which is true of every method including writing a password on paper.
Using generated passwords well
A strong password is only useful if it is unique to one account. The reason is credential stuffing: when any service is breached, the leaked email and password pairs are tried automatically against hundreds of other services, and a reused password turns one company's failure into a compromise of everything you own. This is the single highest-impact security habit, ahead of complexity, rotation or anything else. Uniqueness at scale requires a password manager, because nobody can remember dozens of high-entropy strings — use the manager's own generator or paste one from here, and protect the vault with a long passphrase and multi-factor authentication. Two related points. Forced periodic rotation is no longer recommended by NIST, because it drives people toward predictable increments; change a password when there is reason to believe it is exposed. And multi-factor authentication matters more than password strength for most real-world attacks, since it defeats a stolen password entirely — enable it wherever it is offered, preferring an authenticator app or a hardware key over SMS.
Entropy by length and character set
| Length | Lowercase only | Letters + digits | All printable ASCII |
|---|---|---|---|
| 8 characters | 38 bits | 48 bits | 53 bits |
| 12 characters | 56 bits | 71 bits | 79 bits |
| 16 characters | 75 bits | 95 bits | 105 bits |
| 20 characters | 94 bits | 119 bits | 131 bits |
| 24 characters | 113 bits | 143 bits | 158 bits |
Length scales entropy linearly; character set scales it only logarithmically. Adding length beats adding symbols.
Frequently asked questions
Is it safe to generate passwords on a website?
It is when generation happens entirely in your browser, as it does here. The password is produced by your own device via the Web Crypto API and never sent anywhere — you can verify that in the Network tab.
What makes a password strong?
Length, primarily. Entropy scales linearly with length and only logarithmically with character-set size, so a 20-character password beats a 10-character one using every symbol.
How long should my password be?
16 characters is a solid baseline for ordinary accounts, giving around 105 bits of entropy. Use 20 or more for a password manager's master passphrase or anything high-value.
Why not use Math.random()?
It is a fast pseudo-random generator with no security guarantees and predictable output given enough samples. This tool uses crypto.getRandomValues(), which draws from the OS entropy pool.
Should I use a different password for every account?
Yes, and it is the highest-impact habit available. Credential stuffing turns one breached service into a compromise of every account sharing that password.
Do you store or log generated passwords?
No. Passwords exist only in the tab's memory and are discarded on refresh. Nothing is stored, logged or transmitted — copy it somewhere safe before leaving the page.
Should I change passwords regularly?
Not on a schedule. NIST moved away from forced rotation because it pushes people toward predictable increments. Change a password when you have reason to think it is exposed.
Are complexity rules useful?
Less than people assume. Mandatory symbol and digit requirements produce predictable substitutions like P@ssw0rd1 while adding little entropy. Length is the better lever.
Is a password enough on its own?
No. Multi-factor authentication defeats a stolen password entirely and matters more than strength for most real attacks. Prefer an authenticator app or hardware key over SMS.
Last updated
Guidance follows NIST Special Publication 800-63B on digital identity and authentication. Generation via the Web Crypto API crypto.getRandomValues() interface.