Password Generator

The generator builds each password from the settings you choose. First it takes one random character from every character type you enabled, so each type is guaranteed to appear. It then fills the remaining positions with random characters from the combined pool, and finally shuffles everything so the guaranteed characters don't sit in predictable places.

Every random choice comes from your browser's cryptographically secure random number generator. Each password in a batch is created from fresh randomness. None is a variation of another.

For a randomly generated password, every extra character multiplies the number of possible passwords by the size of the character pool. That is why length is such a powerful lever. With the full character set this tool offers (85 characters), each additional character adds about 6.4 bits of theoretical entropy. A 20-character password from that pool works out at roughly 128 bits, and a 12-character one at roughly 77.

There isn't one universal "perfect" length. Old advice such as "8 characters is enough" no longer reflects how fast passwords can be guessed, and no single number, 16 included, is right for every situation. What's appropriate depends on the service's password policy, whether you use a password manager, how the service protects stored passwords, whether other protections like two-factor authentication exist, and how valuable the account is. When in doubt, go longer.

People are predictable, even when they try not to be. Manually created passwords lean on words, names, keyboard runs, dates and common substitutions (a→@, o→0), and attackers' tools are built around exactly those habits. A password chosen uniformly at random has no such structure to exploit.

The trade-off is memorability: random strings are hard to remember, which is the job of a password manager. For the few passwords you must remember, such as the one that unlocks the manager itself, a long random passphrase can be a better fit.

When a website is breached, the leaked email-and-password pairs are tried automatically on other services, an attack known as credential stuffing. If you reused the password, one breach becomes many compromised accounts. A unique password per account contains the damage, and generating one takes seconds.

It depends on the generator. A trustworthy one uses a cryptographically secure random source, doesn't send passwords anywhere, and doesn't log them. A poor one might use a predictable random function or transmit what it creates. You should be wary of any generator that creates passwords on a server, because the password has then travelled over a network and could be logged.

This generator runs entirely in your browser. You can confirm that for yourself by opening your browser's network panel while you use it: generating, copying and downloading passwords cause no requests that contain a password. It still can't protect against a compromised device, a malicious browser extension or someone looking over your shoulder, which are risks with any password tool.

Ordinary random functions such as Math.random() are built for speed and convenience, and their output can be predicted if enough of it is observed. They are not suitable for security. Browsers instead expose a cryptographically secure generator, crypto.getRandomValues(), which is seeded from the operating system's entropy sources and designed so its output can't be predicted.

Getting random bytes is only half the job. Turning them into a character choice must also be fair. Taking a random number modulo the size of the character set makes some characters slightly more likely than others. This generator uses rejection sampling: numbers that would cause that imbalance are discarded and redrawn, so every character in the pool is equally likely. If a browser can't provide secure randomness, the tool says so and refuses to generate a password, rather than falling back to something weaker.