Password Generator

Generate strong, cryptographically secure passwords directly in your browser — nothing sent to any server.

Length: 16
4128
Number of passwords

Frequently Asked Questions

Passwords are generated using the browser's crypto.getRandomValues() API, which uses the operating system's cryptographically secure pseudo-random number generator (CSPRNG). This is the same source of entropy used by security-sensitive applications. No passwords are ever sent to a server.
A strong password is long (16+ characters), uses all four character classes (uppercase, lowercase, numbers, symbols), has no recognizable words or patterns, and is unique per account. Aim for at least 128 bits of entropy for high-security use cases — this tool shows the entropy in bits for each generated password.
16 characters is the recommended minimum for general accounts; aim for 20+ for financial, email, and administrative accounts. NIST SP 800-63B recommends allowing passwords up to at least 64 characters. Length matters more than complexity: a random 16-character lowercase-only password has ~75 bits of entropy — far stronger than an 8-character mixed-case password with symbols (~52 bits). For high-security systems, use 32 or more characters.
Entropy measures unpredictability in bits. Each bit of entropy doubles the number of possible passwords an attacker must try. Formula: entropy = length × log₂(alphabet size). A password from a 95-character alphabet at 16 characters has ~105 bits of entropy. At 128 bits, a brute-force attack is computationally infeasible even with nation-state resources.
Both can be strong; the choice is a usability vs memorability tradeoff. A random password maximizes entropy-per-character but is hard to memorize. A passphrase using the Diceware method (e.g., correct-horse-battery-staple) is longer but easier to type and remember. Use 6+ words for strong security (~77 bits). For accounts you must type regularly, a passphrase wins; for everything else stored in a password manager, use a random password.
Use a reputable password manager — Bitwarden, 1Password, KeePass, or your browser's built-in vault. Password managers store each credential encrypted and auto-fill it, so you only need to remember one strong master password. Never reuse passwords across sites, never store them in plain-text files, and never email passwords to yourself. Enable two-factor authentication (2FA) on your password manager account.
NIST SP 800-63B updated the conventional wisdom significantly. Key recommendations: allow passwords up to at least 64 characters; do not require periodic password changes unless there is evidence of compromise; do not impose composition rules that users work around with predictable patterns; check passwords against a list of known-compromised passwords; support paste in password fields to enable password managers.
Dictionary attacks try common words, names, and phrases before random character combinations. A password like Summer2024! contains predictable patterns that reduce the effective search space from billions to thousands. Attackers use pre-built lists of hundreds of millions of known passwords from data breaches. Always use passwords generated by a CSPRNG with no dictionary words.
Modern guidance from NIST says: do not change passwords on a fixed schedule if they are strong and unique. Forced rotation leads users to make predictable small changes. You should change a password immediately if: there is a data breach involving that service, you suspect it was seen by someone else, or you shared it temporarily.
A password is a human-chosen secret used to authenticate a person. An API key is a machine-generated token used to authenticate a program — typically 32–64 random characters, transmitted in HTTP headers (Authorization: Bearer …), and rotated programmatically. Unlike passwords, API keys are not hashed with bcrypt on the server side — they are typically stored as a SHA-256 hash or split into an identifier + secret.

About This Password Generator

This free password generator creates cryptographically random passwords with configurable length and character sets. All generation happens in your browser using the Web Crypto API; no passwords are transmitted or stored.

When to use this tool

  • Generating a strong master password for a password manager
  • Creating random passwords for test and service accounts
  • Meeting specific password policy character requirements
  • Producing credentials for database users or API services

Related Developer Tools

Bcrypt Generator Hash Generator UUID Generator Random String

Related Articles

In-depth guides and technical articles.

View all →
Why Composition Rules Make Passwords Weaker, Not Stronger
Developer Oct 1, 2026
Why Composition Rules Make Passwords Weaker, Not Stronger
Composition rules reduce entropy, symbols break config files, and bcrypt silently ignores anything past 72 bytes. What actually makes a generated password work.
SMS and TOTP Can Both Be Phished in Real Time — Here's Which MFA Methods Are Actually Phishing-Resistant
Developer Jul 10, 2026
SMS and TOTP Can Both Be Phished in Real Time — Here's Which MFA Methods Are Actually Phishing-Resistant
SMS OTP and TOTP are both vulnerable to real-time phishing (AiTM attacks relay codes before they expire) — hardware keys and passkeys are phishing-resistant because their response is cryptographically bound to the exact URL. Here's the MFA security spectrum from SMS to passkeys, the MFA fatigue (push bombing) attack that compromised Uber in 2022, why number matching prevents rubber-stamping push notifications, and why security questions aren't a genuine second factor.
Why a Password Generator Using Math.random() Is Less Secure Than Its Length Suggests — Entropy, CSPRNG, and What to Check
Developer Jun 23, 2026
Why a Password Generator Using Math.random() Is Less Secure Than Its Length Suggests — Entropy, CSPRNG, and What to Check
A password generator using Math.random() is not cryptographically secure — a password's effective entropy is limited by the randomness quality of the generator, not just its length and character set. Here's what password entropy actually measures (bits of theoretical guessing difficulty), why crypto.getRandomValues() is categorically different from Math.random(), why length increases entropy faster than adding special characters, and how Diceware achieves verifiable physical randomness.
Why a Strong Password Isn't Enough: Credential Stuffing and the Case for Unique Passwords Everywhere
Developer Jun 16, 2026
Why a Strong Password Isn't Enough: Credential Stuffing and the Case for Unique Passwords Everywhere
A password can be long, random, and never appear in any breach — and still get your account compromised, because the attack that actually breaks most accounts isn't guessing your password, it's trying a password that worked on a completely different site you used years ago. Here's how credential stuffing works, why password "strength" is irrelevant to this specific attack, and why a generator-plus-manager combination — making unique-per-site passwords practically achievable — directly closes this vector.
Passkeys: How FIDO2/WebAuthn Works and Why It's Replacing Passwords
Developer Jun 13, 2026
Passkeys: How FIDO2/WebAuthn Works and Why It's Replacing Passwords
Passkeys store a private key on your device and register only the public key with the website — there's nothing to phish, breach, or reuse. Here's how FIDO2/WebAuthn registration and authentication work, the difference between platform passkeys (iCloud, Google) and hardware keys, and the current state of passkey adoption.