Password Generator

How Password Generator Works

Unlike simple randomization based on Math.random(), this generator uses the Web Crypto API's getRandomValues(), which is designed to be cryptographically unpredictable — the same standard used for security-sensitive operations in the browser, rather than general-purpose randomness.

It builds a character pool from whichever sets you enable (uppercase, lowercase, numbers, symbols), optionally removing visually similar characters like 0, O, I, l, and 1 if you want to avoid transcription mistakes, then picks each character of your password independently from that pool.

The "estimated entropy" figure is calculated as log2(pool size ^ password length) — it represents how many random guesses, in powers of two, an attacker would need to try every possible combination. Higher entropy means a password that takes exponentially longer to brute-force.

Who Uses Password Generator and Why

• Creating a unique, high-entropy password for a new account instead of reusing a password from another site.
• Generating a batch of strong passwords when setting up several new service accounts at once.
• Producing a password meant to be read aloud or typed manually from a printed slip, using the exclude-similar-characters option to avoid misreading 1, l, and I.
• Replacing a weak, memorized password on an existing account with something a brute-force tool can't feasibly guess.

Mistakes to Avoid

• Generating a password and then only using lowercase letters and numbers because symbols feel inconvenient — disabling character sets shrinks the pool the generator draws from, which reduces the total possible combinations and makes the password easier to guess.
• Reusing the same generated password across multiple accounts — a strong password only protects the one account it's used on; reuse means a breach on one site compromises every account sharing it.
• Choosing a short length because it's easier to remember — length matters more than character variety for resisting brute-force attempts, so cutting length undermines the whole point of generating a random password.
• Assuming a password manager isn't needed because the password is strong — a truly random 16+ character password isn't memorizable by design, so it needs to be stored somewhere secure rather than memorized or written down insecurely.

Tips for Best Results

• Pair a generated password with a password manager rather than trying to memorize it — that's the only practical way to use a genuinely random string without reusing it or writing it down insecurely.
• For accounts that support two-factor authentication, turn it on in addition to using a strong generated password — length and randomness protect against guessing, but 2FA protects against a leaked password being reused elsewhere.

Fixing Common Problems

A site rejects the generated password as invalid. — Some sites restrict certain symbols or cap maximum length — turn off the symbol set or shorten the length slightly and regenerate until it fits that site's specific rules.

I'm not sure if the password is actually being generated securely. — The generator runs entirely in your browser and the password is never transmitted to or stored on the server, so there's nothing external to intercept it — the randomness comes from your browser's own random number generation.

Terms Explained

Entropy: A measure of how unpredictable a password is, based on its length and the size of the character pool it's drawn from — higher entropy means more possible combinations an attacker would have to try.

Brute-force attack: An attempt to guess a password by systematically trying combinations until the correct one is found — longer, more random passwords make this take impractically long.

Character pool: The full set of characters (uppercase, lowercase, numbers, symbols) available for the generator to randomly select from when building a password.