Password Generator

What does this Password Generator do?

This tool generates random, strong passwords entirely in your browser, with full control over length and which character types (uppercase, lowercase, numbers, symbols) to include.

How it works

The generator uses your browser's crypto.getRandomValues() API — a cryptographically secure random number source built into every modern browser, distinct from and stronger than JavaScript's ordinary Math.random(), which is not designed for security-sensitive use. Each character in your password is picked independently and uniformly at random from your selected character set.

Why length matters more than complexity

A password's resistance to brute-force guessing grows exponentially with length. A 16-character password drawn from a large character set has vastly more possible combinations than an 8-character one, even a complex 8-character one — which is why security guidance has increasingly shifted toward "longer is better" over purely complexity-based rules.

Tips & common mistakes

• Aim for at least 16 characters when the service allows it — length is the single biggest lever for password strength.
• Use a unique password for every account — a password manager makes this practical without having to memorize dozens of random strings.
• Avoid using easily guessable substitutions of dictionary words (like "P@ssw0rd") — these are well known to password-cracking tools and offer far less real protection than they appear to.

Why "random" needs to mean cryptographically random

Not all "random" number generation is equally unpredictable. JavaScript's ordinary Math.random() is a pseudo-random generator designed for things like game animations and visual effects — it's fast, but its output can, in principle, be predicted or reverse-engineered by someone who knows the underlying algorithm and enough prior outputs. The Web Crypto API's crypto.getRandomValues(), which this generator uses, draws from the operating system's cryptographically secure random source — the same category of randomness used to generate encryption keys — making it appropriate for anything security-sensitive, including passwords.

Understanding password entropy

"Entropy" is the technical measure of how unpredictable a password is, usually expressed in bits. Each additional character, and each additional character type included in the pool (uppercase, lowercase, numbers, symbols), multiplies the total number of possible passwords — which is why entropy grows so much faster with length than with adding a single extra symbol to a short password. A 20-character password using only lowercase letters can be more resistant to brute-force guessing than an 8-character password using every character type available.

More tips

• Password managers remove the practical downside of using long, fully random, unique passwords for every account — you only need to remember one master password instead of dozens of complex ones.
• If a service enforces a maximum password length under 12–16 characters, that's a mild red flag about their security practices — modern best practice generally supports long passwords without an unreasonably low cap.
• Changing passwords on a fixed schedule (like every 90 days) with no other reason is now considered less valuable than previously believed — the bigger win is length, uniqueness per site, and changing a password immediately if a service reports a breach.

Frequently asked questions