What is a Password Generator?
Password strength is entropy: how many guesses an attacker needs. Human-invented passwords are predictable; 16 random characters from a full charset (~100 bits) are effectively unguessable.
This generator uses your browser’s cryptographic random source with unbiased sampling, guarantees at least one character from each chosen set, and shows an honest entropy estimate. The password is generated on your device: it is never transmitted, stored or seen by us.
Where the generated password should go: a password manager, immediately. The manager remembers it, fills it, and makes per-site unique passwords practical: which matters because credential stuffing (trying your leaked password everywhere) is how accounts actually fall. One strong memorized passphrase for the manager, generated randomness for everything else.
Why the randomness here is worth checking
Most generators take a random number and apply a remainder to pick a character. That introduces modulo bias: some characters in the set become measurably more likely than others, because the range does not divide evenly. The effect is small, and it is the kind of small that cryptographers care about, because it shrinks the real search space below the one the length implies.
This generator draws from the browser cryptographic source and uses rejection sampling: values that would fall in the uneven tail are discarded and redrawn, so every character in the set is equally likely. It also guarantees at least one character from each set you enabled, then fills the rest from the combined pool, which is what makes a password satisfy a site composition rule without you regenerating it five times.
Nothing is transmitted. The password is produced by your own browser, is never sent anywhere, and is not stored: closing the tab is the end of it, so copy it into your password manager before you leave.
Frequently asked questions
What about passphrases like correct-horse-battery-staple?
Excellent for the few passwords you must type from memory: five random words carry ~64 bits and are far easier to enter on a TV keyboard. For everything a manager fills, generated characters win.
Should I rotate passwords regularly?
Modern guidance (NIST) says no: forced rotation breeds weak patterns. Change a password when there is a reason: a breach notification, shared access ending, or suspicion.
How long should a password be?
16+ random characters for anything that matters. Length beats cleverness: every added character multiplies the search space.
Is it safe to generate passwords on a website?
Here, yes: generation uses crypto.getRandomValues locally and the password never leaves your device. We could not log it if we wanted to.
What do the “bits” mean?
Entropy: log2 of possible passwords. ~50 bits is crackable with effort; 70+ strong; 90+ effectively unbreakable today.
Should I avoid symbols for sites that reject them?
Untick symbols and add length instead: 20 alphanumeric characters beat 14 with symbols.