Password Generator
Free online password generator using Web Crypto CSPRNG for strong random passwords, passphrases, and PINs. Strength detection, ambiguous char exclusion, batch export. Browser-local.
Related
What is a Secure Password Generator?
A password generator creates random, unpredictable passwords. Unlike human-chosen passwords, a true generator uses a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) to randomly select characters from a specified pool, avoiding predictable human patterns (name+birthday, keyboard sequences like qwerty, company+year), drastically reducing risk from dictionary attacks and credential stuffing.
**Why not Math.random()?** General PRNGs have internal state that can be reverse-engineered from small outputs, allowing attackers to predict future "random" numbers. This tool uses the browser Web Crypto API — backed by OS-level CSPRNGs (Linux getrandom, macOS SecRandomCopyBytes, Windows BCryptGenRandom) that pass cryptographic randomness tests.
**Entropy is the core of password strength**: Entropy = log₂(N^L) bits, where N = character pool size and L = length. A 16-char password from 94 printable ASCII chars has ~104 bits — averaging 2¹⁰³ guesses to crack, or about 200 billion years at 1 trillion guesses/sec.
**Passphrases** made of multiple randomly chosen words (like Brave-Cloud-Star42) look "simpler" but achieve 60+ bits when words are truly random — enough for most scenarios, and much easier to remember than random-character passwords. This is the Diceware / XKCD #936 approach.
All passwords are generated locally in your browser with zero upload. The tool also provides strength detection: entropy calculation, brute-force time estimation, and weak pattern detection (repeated chars, sequential digits/letters, common password matching).
Use Cases
- Generate strong random passwords for new accounts, check entropy and crack time
- Batch-generate temporary credentials for teams or test environments
- Generate memorable passphrases for Wi-Fi or device passwords
- Set device PINs, initialize admin accounts, or reset passwords
- Replace weak, human-created passwords with strong random ones
How to Use
- Select mode: Random, Passphrase, or PIN
- Set length, character options (16+ recommended), optionally exclude ambiguous chars
- Review strength: entropy, crack time estimate, weak password detection
- Copy or batch export to TXT for registration/reset/distribution
Features
- CSPRNG generation: uses browser Web Crypto (crypto.getRandomValues) for cryptographically secure randomness
- Three modes: Random password, Memorable passphrase (word combination), Numeric PIN
- Full strength meter: character pool size, entropy, weak password detection, sequential/repeated char risk, brute-force time estimate
- Exclude ambiguous: optionally skip 0/O/1/l/I for manual entry scenarios
- Batch generation: generate 5/10/20 passwords at once with TXT download
- Local-only: all generation and analysis happens in browser, no data uploaded
Random Password vs Memorable Passphrase vs Numeric PIN: Which to Choose?
Each of the three password modes has trade-offs. Picking the wrong one means you cannot remember it, it gets stolen easily, or it simply does not fit the scenario. Decide based on 'who remembers it, who types it, who stores it' to avoid common pitfalls.
| Mode | Typical Question to Pick It | Security Strength | Ease of Use | Typical User |
|---|---|---|---|---|
| Random Password | (I never type it manually, my password manager autofills it) | High (16 chars reach ~104 bits) | Poor (unmemorable, requires manager) | Primary email, banking, social accounts, API keys |
| Memorable Passphrase | (I want to be able to speak it, type it, and still be secure) | Medium-High (5-6 Diceware words ~64-77 bits) | Good (human-readable, pronounceable) | Master password, Wi-Fi, cross-device passwords |
| Numeric PIN | (Only 0-9 allowed, device restricted) | Low (6 digits only ~20 bits, 10 digits still ~33 bits) | Good (numeric keypad works) | Device lock screen, bank card PIN, one-time codes |
Best Practices
Save generated passwords in a manager immediately, do not leave them on screen for long
A freshly generated strong password is in fully plaintext state, lingering in clipboard, on screen, or in browser history are all risk points. Generate, then immediately paste into the target site, then clear clipboard. Do not insert any other work in between those three steps. **Never** screenshot a generated password to your photo album, and never write it on paper and send a photo of it to others. This tool keeps passwords only in the current page; they are lost on refresh or tab close, so prepare the storage location before clicking generate.
Do passwords get uploaded to a server?Use a **long memorable passphrase** for the master password, 16-20 char random passwords for everything else
Layered strategy: the master password (unlocking the password manager) must be humanly memorizable and strong enough - choose a 5-6 word Diceware passphrase. For the other 99% of sites/services, use 16-20 char random passwords with a password manager's autofill. **Never** use a memorable passphrase for every site (cannot remember them, easy to weaken), and **never** use a random password for the master password either (you will write it down, security goes to zero). This is the core layered thinking of password management.
How long should a password be?Random password vs memorable passphrase?Only exclude ambiguous characters when manual entry is required
Excluding 0/O/1/l/I and other ambiguous characters significantly reduces the character pool size (5-10 bits of entropy loss for the same length). **Only enable when** manual entry, phone dictation, or printed distribution is needed. If the password is only used inside a password manager, keeping all printable characters yields higher entropy. A simple test: (Will I ever need to type this password with my fingers?) If yes, exclude; if no, do not exclude.
Why exclude ambiguous characters (0/O/1/l/I)?Batch generation is only for testing/distribution scenarios, do not reuse them for production accounts
The workflow of batch-generating 5/10/20 passwords mainly applies to: test environment initialization, temporary account distribution, invite code generation, one-time API key output. **Do not** pick one from a batch result and reuse it for your own production account - batch-generated passwords usually follow the same generation rules with obvious signatures (character set, length, generator type); once one account leaks, attackers can guess the structural differences of the other batch passwords. Generate and store production account passwords individually.
Local-only generationNew passwords must be paired with 2FA to be truly secure
Even the strongest password collapses against phishing, keyloggers, password database leaks, or insider threats at carriers. **Every important account (email, banking, social, cloud storage) must enable 2FA**. Recommended order: TOTP (Google Authenticator / Authy) > hardware key (YubiKey) > SMS. **Avoid SMS 2FA** (SIM swap attacks can bypass it). Strong password + 2FA + password manager are all required - 2FA is the last line of defense after a password leak.
NIST SP 800-63B - Digital Identity GuidelinesCheck HIBP first before deciding whether to reset a leaked password
When you suspect a password leaked (seeing news that some site was breached, receiving phishing emails, etc.), do not change it immediately. First, use the Pwned Passwords API of Have I Been Pwned (HIBP) to check whether that password actually appears in any known breach corpus. HIBP offers a k-anonymity API, which this tool may integrate in the future; for now, you can manually go to haveibeenpwned.com/Passwords and search with the first 5 characters of the SHA-1 hash. Only reset urgently if confirmed in the corpus; passwords that are not in the breach corpus do not need forced change for (psychological comfort) (NIST explicitly does not recommend periodic resets).
Have I Been Pwned - Check Password BreachesFAQ
Why Web Crypto API instead of Math.random()?
Math.random() is a general PRNG not designed for security — its internal state can potentially be reverse-engineered. crypto.getRandomValues() uses the OS-level CSPRNG, producing unpredictable randomness suitable for passwords and keys.
Do passwords get uploaded to a server?
No. All passwords are generated locally in your browser. Strength analysis, entropy calculation, and crack time estimation all run client-side. DevTools Network tab confirms zero requests.
How long should a password be?
At least 12 characters with mixed case, digits, and symbols. A 16-character random password would take billions of years to brute-force at modern speeds. See the crack time table above.
Random password vs memorable passphrase?
Per-character, random passwords have higher entropy. But passphrases (4-6 truly random words) achieve 60+ bits of entropy and are much easier to remember. The key is truly random word selection, not self-invented phrases.
Why exclude ambiguous characters (0/O/1/l/I)?
These look similar in many fonts and cause input errors. If passwords are typed manually, read over phone, or printed, exclude them. If used only via password manager, keep all characters for higher entropy.
Is rotating passwords more secure?
Per NIST SP 800-63B, regular password rotation is NO longer recommended unless compromise is confirmed. Forced rotation leads users to choose weak passwords or write them down. Better: long random passwords + password manager + 2FA.
What is password entropy?
Entropy measures unpredictability in bits. Entropy = log₂(character_pool_size ^ length). A 16-char password from 94 printable ASCII chars has ~104 bits, meaning an attacker averages 2¹⁰³ guesses — about 200 billion years at 1 trillion guesses/sec.
Glossary
- CSPRNG
- Cryptographically Secure Pseudo-Random Number Generator. Produces unpredictable output that passes rigorous randomness tests; even knowing many past outputs does not reveal future ones.
- Password Entropy
- Measures unpredictability in bits. Formula: log₂(N^L). 60+ bits = secure; 100+ bits = extremely strong.
- Brute Force Attack
- Trying all possible character combinations. Defended by using long random passwords that make combinations physically uncountable.
- Dictionary Attack
- Using lists of common passwords (123456, password, qwerty) to guess credentials. Much faster than brute force; random passwords are immune.
- Credential Stuffing
- Using leaked username/password pairs from one site to attempt login on others. Defended by unique passwords per site and checking Have I Been Pwned.
- Passphrase
- A password made of multiple random words. Easier to remember with high entropy when words are truly random (Diceware method).
- Diceware
- Arnold Reinhold's 1995 method using 5 dice rolls to pick words from a 7776-word list. 6 Diceware words ≈77 bits of entropy.
- NIST SP 800-63B
- NIST digital identity guidelines — the authoritative reference for password security. Since 2017, it no longer recommends regular rotation or mandatory special characters, emphasizing length, breached-password screening, and MFA.
- 2FA/MFA
- Two-Factor / Multi-Factor Authentication requires a second factor beyond password (TOTP, hardware key). NIST recommends 2FA on all important accounts.
- Breached Password Blacklist
- Lists of publicly known compromised/common passwords (123456, password, admin, qwerty). NIST recommends checking against such lists at registration/password change.
Password Length vs Crack Time (upper+lower+digits+symbols)
| Length | Entropy(bit) | Combinations | Crack Time (1T guesses/sec) | Rating |
|---|---|---|---|---|
6 chars | ~37 | ~139 billion | < 1 second | ❌ Very weak |
8 chars | ~52 | ~2.2×10¹⁴ | ~2.5 days | ❌ Weak |
10 chars | ~65 | ~3.7×10¹⁸ | ~116 years | ⚠️ Fair |
12 chars | ~78 | ~6.1×10²² | ~1.9 million years | ✅ Strong |
16 chars | ~104 | ~6.3×10³⁰ | ~200 billion years | ✅✅ Very strong |
20 chars | ~131 | ~6.7×10³⁸ | Trillions of universe ages | ✅✅✅ Unbreakable |
Three Password Modes Comparison
| Mode | Example | Typical Entropy | Memorability | Best For |
|---|---|---|---|---|
| Random Password | xK9#mP2$vL8@nQ4! | ~6.5bit/char | Poor | Password-manager stored main passwords, DB passwords, API keys |
| Memorable Passphrase | Brave-Cloud-Star42 | ~10bit/word | Good | Wi-Fi passwords, login passwords requiring manual entry |
| Numeric PIN | 482917 | 3.3bit/digit | Good | Device lock screen, bank card PIN, one-time codes |
Authoritative References
- Color Blind Simulator
- Color Converter
- .htaccess to Nginx Converter
- SQL Converter
- Cookie Parser
- Cron Expression Generator
- Cron Expression Validator
- CSS Formatter
- CSS Minifier
- CSV to Excel
- CSV Viewer
- CSV Editor
- Currency Converter
- Diff Checker
- Excel to CSV
- Favicon Generator
- CSS Formatter
- HTML Formatter
- Markdown Formatter
- XML Formatter
- Hexadecimal Converter
- HTML Formatter
- HTML Minifier
- HTML to Markdown
- Markdown to HTML
- JavaScript Formatter
- JS Minifier
- JSX Formatter
- JSX Minifier
- Keyword clustering
- Lorem Ipsum Generator
- Markdown Table Generator
- Meta Tag Generator
- Password Generator
- Password Strength Checker
- QR Code & Barcode Generator
- Regex Tester
- Slug Generator
- SQL Builder
- SQL Formatter
- Word Counter
- Text Translator
- Time Tools
- TS Formatter
- TS Minifier
- TSX Formatter
- TSX Minifier
- Unix Timestamp Converter
- UUID Generator
- YAML Formatter
- Case Converter