Password Generator

Length beats complexity

Every character you add multiplies the search space. Every rule about symbols and capitals adds a little. Length wins, and it is not close.

A 20-character lowercase-only password has about 94 bits of entropy. A 12-character password using all four character sets has about 78. The longer, simpler one is roughly 60,000 times harder to guess.

This is why the old advice — eight characters with a capital, a digit and a symbol — has been abandoned. It produces passwords that are hard for people to remember and easy for computers to guess, which is exactly the wrong way round. Modern guidance from NIST and the UK's NCSC asks for length and drops the composition rules.

What the crack time assumes

The estimate above assumes an offline attack at a hundred billion guesses a second — someone who has stolen a password database and is attacking a fast hash with good hardware. It is a deliberately pessimistic scenario.

Online attacks against a live login are millions of times slower, because the server rate-limits. But you should assume the pessimistic case, because databases do get stolen and you will not be told promptly.

The rule that matters more than any of this

Never reuse a password. A perfect password used on two sites is only as safe as the weaker one. When that site is breached — and it will be — attackers immediately try the same combination everywhere. This is credential stuffing, and it is how most accounts are actually lost.

Which means you need a different strong password per site, which means you cannot remember them, which means you need a password manager. That is not an optional extra; it is the thing that makes the rest of the advice possible.

Passphrases are a good alternative

Four or five random words — chosen by dice or software, not by you — give comparable strength and are far easier to type on a phone or a games console. "correct horse battery staple" is the famous example.

The critical word is random. Words you chose yourself, or a memorable phrase, are dramatically weaker than they look, because attackers use dictionaries of exactly that.

Where these passwords go

Nowhere. They are generated in this page by your browser's cryptographic random source, never transmitted, and never stored. Reload and they are gone.

That is worth caring about: a password generator on someone else's server sends you a password that server has seen.

Common uses

• A new account you are creating now.
• Rotating a password after a breach notification.
• Generating API keys or service credentials.
• A Wi-Fi password that guests can actually type — turn off symbols for that.

Questions people ask

How long should a password be?

Sixteen characters or more for anything that matters. Length contributes far more than composition rules do.

Are symbols and capitals necessary?

Less than people think. A 20-character lowercase password is far stronger than a 12-character one using every character set.

Is this password generator safe?

It runs entirely in your browser using the cryptographic random source, and nothing is transmitted or stored. A generator on someone else's server sends you a password that server has seen.

What is the single most important rule?

Never reuse a password. A stolen password from one site is immediately tried everywhere else, which is how most accounts are lost.

Are passphrases as good?

Yes, if the words are chosen randomly by software or dice. Words you picked yourself are much weaker than they appear.

How is the crack time calculated?

It assumes an offline attack at a hundred billion guesses a second against a fast hash — deliberately pessimistic.

Where the randomness comes from

Every result on these pages uses crypto.getRandomValues, your browser's cryptographically secure random generator, seeded by the operating system from genuinely unpredictable physical sources.

That is deliberately not Math.random(), which most tools use. Math.random is a deterministic algorithm producing numbers that look random; given enough output, its future values can be predicted. For a dice game that does not matter. For a prize draw, a password or anything anyone might want to game, it does.

The numbers are also produced by rejection sampling rather than by taking a remainder. Taking a random 32-bit number modulo 6 slightly favours the lower faces, because 2³² does not divide evenly by 6. The bias is small and it is real, and discarding the leftover tail removes it completely.

Nothing leaves the page

Results are generated in your browser and are not transmitted or stored. Reload the page and they are gone — which matters most on the password generator.