-
Very weak
How to use
01
Set the length slider
Drag the Length slider between 8 and 64 characters. It starts at 16, a sensible floor for anything important. Longer is stronger, so push it higher when the account really matters.
02
Tick the character classes
Four checkboxes control the alphabet: A-Z, a-z, 0-9, and symbols like !@#$. Untick symbols if a legacy site rejects them, and the tool rebuilds the result from whatever classes remain.
03
Copy or regenerate
The strength badge rates the output from Very weak to Very strong on a five segment meter. Hit Regenerate for a new candidate, then use the copy button to grab it.
Why Password Generator
- Uses crypto.getRandomValues(), cryptographically secure.
- Live strength meter.
- Never touches a server. Generated only in your browser.
Common questions
Where does the randomness for each password come from?
It calls crypto.getRandomValues(), which fills a typed array with values from your operating system's cryptographically secure random source. That's the same primitive password managers rely on. Math.random() is never involved, because its output is predictable enough to be attacked.
Is a 16 character password actually strong enough?
With all four character classes ticked, each character is drawn from an 88 symbol alphabet, giving a 16 character result roughly 103 bits of entropy. That's far beyond any realistic brute force effort. For a password manager master key, consider 24 characters or more anyway.
Can I generate a password without symbols for older sites?
Yes. Untick the !@#$ checkbox and the tool draws only from letters and digits. You lose a little entropy per character, so compensate by dragging the slider up; four extra characters more than covers the difference.
What does the password strength badge actually measure?
It's a quick heuristic, not a full entropy calculation. The score rewards passing 8 and then 12 characters, plus the presence of mixed case, digits, and symbols. Treat Very strong as a sanity check, and treat length as the real dial.
Why is a long password better than a short complex one?
Each added character multiplies the search space, while swapping a letter for a symbol only nudges it. Twenty lowercase letters carry about 94 bits of entropy; twelve characters using every class carry about 79. Cracking rigs also mutate dictionary words with symbol substitutions automatically, so complexity tricks buy less than they appear to.
Does the generated password ever leave my browser?
No. There's no network request at any point; the string exists only in your tab's memory and disappears when you close it. That's what makes a client side secure password maker safer than any server backed option, since there's no server to breach.
Should every account get a different random password?
Yes. Credential stuffing attacks replay leaked email and password pairs against hundreds of other sites, so one reused string turns a single breach into many. Generate a fresh one per account and let a password manager remember them.