Password / password-generator
Secure password generator
Cryptographic randomness, not Math.random().
- Sourcecrypto.getRandomValues()
- Entropy—
- draws237
This page does not use Math.random(). Every character comes from crypto.getRandomValues(), the browser cryptographic PRNG — the same primitive that protects TLS sessions. The difference is not academic. Math.random() is deterministic: whoever knows its internal state can rebuild the sequence. For a password that means predictability.
Entropy is the number of bits an attacker needs to brute-force the value. Sixteen characters over a 94-symbol alphabet is roughly 104 bits, out of reach for any offline attack. A five-word passphrase from a 7,776-word list is roughly 65 bits, but it lives in your memory instead of a file.
How it works
- 01Pick a mode: random characters for maximum density, passphrase for human memory.
- 02Tune the alphabet. Every symbol removed costs entropy: the counter at the top updates as you change options.
- 03Copy in one click. The password exists only in this tab: no value is ever transmitted.
Frequently asked
Secure password generator
Can the site see my passwords?
No. Generation happens entirely in the browser with the Web Crypto API. The server only receives an anonymous counter: how many generations, how many bits, never the result.
Is 12 complex characters better than 20 simple ones?
Longer wins. Entropy grows linearly with length and only logarithmically with alphabet size: doubling length doubles the bits, adding 30 symbols adds about five.
Are these passwords safe for production?
Yes, they come from a CSPRNG. Store them in a password manager anyway: generation is solid, human memory is not.