Strong Password Generator
Build cryptographically random passwords with a live entropy strength meter.
Generate Strong, Cryptographically Random Passwords
Passwords fail for two reasons: they are guessable, and they are reused. A generated random password fixes the first problem completely — there is no pattern, no dictionary word and no personal detail for an attacker to exploit. A password manager fixes the second by making a unique password per site practical.
This generator draws from crypto.getRandomValues(), the browser’s cryptographically secure random number source, not from Math.random() — which is predictable and must never be used for secrets. The strength meter shows real entropy in bits rather than a vague colour-coded guess, so you can see exactly how much security your settings actually buy.
Key features
- CSPRNG-backed — every character comes from the Web Crypto API with rejection sampling to avoid modulo bias.
- Entropy meter in bits — a real calculation of log₂(alphabet^length), with an estimated offline cracking time.
- Full character control — length 4–128, with uppercase, lowercase, digits and symbols toggled independently.
- Ambiguity filter — optionally exclude look-alike characters such as l, I, 1, O and 0 for passwords you must type by hand.
- Bulk generation — produce a batch at once when setting up multiple accounts or service credentials.
This tool runs entirely inside your browser using native Web APIs. Your files and text are never uploaded to a server, never logged and never shared with third parties.
How to use: Strong Password Generator
- Set the length
Sixteen characters is a good everyday minimum; twenty or more for email, banking and anything holding recovery access. - Choose character sets
Enable uppercase, lowercase, numbers and symbols. Every set you add widens the alphabet and raises entropy. - Check the entropy reading
Aim for 75 bits or more. Below 60 bits is weak against a determined offline attack on a leaked password hash. - Copy it into your password manager
Generate, copy and save it immediately. Never reuse a password across sites, however strong it is.
Technical specifications
| Processing location | Entirely in your browser — no server round trip |
|---|---|
| Data uploaded | None. Files and text never leave your device |
| Price | Free — no account, no trial, no usage cap |
| Category | Security |
| Works offline | Yes, once the page has loaded |
| Browser support | Chrome 90+, Edge 90+, Firefox 90+, Safari 15+ |
| Interface languages | English, 中文, हिन्दी, Español, العربية |
Frequently asked questions
Are these passwords generated on a server?
No — and that is the point. Generation happens entirely in your browser using the Web Crypto API. The password is never transmitted, never logged and exists only in your tab and your clipboard.
How long should a password be?
Sixteen characters from a mixed alphabet gives roughly 100 bits of entropy, which is beyond brute force with any foreseeable hardware. Twelve is an acceptable floor; anything under ten is genuinely weak today.
What is entropy and why is it measured in bits?
Entropy measures unpredictability. Each bit doubles the number of possible passwords, so 70 bits means roughly 10²¹ possibilities. It is a mathematical property of how the password was generated — which is why it beats "strength" heuristics based on pattern matching.
Should I include symbols?
They help, but length helps more. Adding symbols widens the alphabet from 62 to about 94 characters, worth roughly 0.6 extra bits per character — while each additional character is worth about 6 bits. Prefer a longer password over a more exotic short one.
Is it safe to generate a password on a website at all?
It depends entirely on whether the generation is local. Here it is: you can disconnect from the network, and the tool still works. If a generator requires a server round trip, do not trust it with a password you intend to use.