About this tool
A strong password is the first line of defence for any online account. NIST (National Institute of Standards and Technology) defines a strong password as at least 12–16 characters long drawn from a large character set — combining uppercase letters, lowercase letters, numbers, and symbols. The more characters and the more varied the set, the harder the password is to crack by brute force.
Password entropy measures how unpredictable a password is, in bits. The formula is: Entropy = Length × log₂(Character Set Size). A password using only lowercase letters (26 characters) at 8 characters long has roughly 37.6 bits of entropy. By contrast, a 20-character password using ~94 printable ASCII characters has approximately 131 bits — exponentially harder to crack. This tool displays the entropy of every password it generates.
Passphrases are an alternative to random character strings. Popularised by the Diceware method and the XKCD "correct horse battery staple" comic, a passphrase is a sequence of random words joined by a separator (e.g. "glacier-horizon-cipher-vanguard"). A 4-word passphrase from a 7,776-word list provides ~51.7 bits of entropy; a 6-word passphrase provides ~77 bits — sufficient for most accounts — while being far easier to remember than random characters.
This generator uses the Web Cryptography API (window.crypto.getRandomValues), the cryptographically secure random number generator (CSPRNG) built into every modern browser. Unlike Math.random(), which is a pseudo-random generator unsuitable for security, window.crypto.getRandomValues is designed to be unpredictable. All generation happens locally in your browser — passwords are never sent to any server.
Practical Usage Examples
Step-by-Step Instructions
Choose the generation mode: Random Characters, Passphrase, or Hex Token.
Set the desired length (characters for Random/Hex, words for Passphrase).
For Random Characters, select which character types to include: uppercase, lowercase, numbers, symbols.
For Passphrase, choose the word separator (hyphen, space, or none).
Click "Generate" to create your password.
Check the entropy score to assess strength.
Click "Copy" to copy the password to your clipboard.
Core Benefits
Cryptographically secure generation using window.crypto.getRandomValues.
Three modes: Random Characters, Passphrases, and Hex Tokens.
Real-time entropy calculation showing bits of security.
Configurable character sets and length for any use case.
Bulk generation for creating multiple passwords at once.
100% client-side — passwords never leave your browser.
Free, no signup, no tracking, works offline after first load.
Frequently Asked Questions
A strong password is long (at least 12–16 characters) and drawn from a large character set (uppercase, lowercase, numbers, symbols). NIST recommends length over complexity — a 16-character password with only lowercase letters is stronger than an 8-character password with mixed types. Entropy (unpredictability) is the key metric.
Entropy measures how unpredictable a password is, in bits. Formula: Entropy = Length × log₂(Character Set Size). Higher entropy = harder to crack. A password with 40+ bits is strong for most purposes; 80+ bits resists state-level attackers. This tool calculates entropy for every generated password.
Yes, if properly constructed. A 6-word Diceware passphrase (7,776-word list) provides ~77 bits of entropy, comparable to a 13-character random string from a 94-character set. Passphrases are much easier to remember, making them ideal for master passwords you type frequently.
Math.random() is a pseudo-random number generator (PRNG) — deterministic and predictable if you know the seed. window.crypto.getRandomValues() is a cryptographically secure PRNG (CSPRNG) designed to be unpredictable. Never use Math.random() for security purposes.
No. All generation happens locally in your browser. No passwords are ever sent to any server, logged, or stored. Your privacy is guaranteed.