Random Password Generator

What Makes a Password Strong

Password strength is not about looking complicated — it is about how many guesses an attacker needs. That quantity is called entropy, measured in bits, and for a randomly generated password it is simply length x log2(size of the character pool). A 12-character lowercase-only password draws from 26 symbols and carries about 56 bits. Add uppercase and digits and the pool grows to 62, lifting the same length to roughly 71 bits. Add symbols and 12 characters reaches about 78 bits.

The word randomly is load-bearing. A password a human invented has far less entropy than its length suggests, because humans reach for names, dates, keyboard runs, and the same substitutions everyone else uses. Cracking tools model those habits directly. P@ssw0rd!23 is eleven characters and falls in seconds; eleven characters chosen at random do not.

How This Generator Picks Characters

Each character comes from crypto.getRandomValues(), the browser's cryptographically secure random number generator, seeded by the operating system entropy pool. This matters more than it sounds: the ordinary Math.random() is a fast, non-cryptographic PRNG whose future output can be reconstructed by an attacker who has seen enough previous values, which makes it unfit for generating credentials.

The generator also rejects raw random bytes that fall in the final partial block before mapping them onto the character pool. Without that step, the first few characters of the pool would be selected slightly more often than the rest — a subtle bias called modulo bias that quietly shrinks the real keyspace.

Choosing Length and Character Sets

• Length beats complexity. Adding one character multiplies the search space by the pool size; adding a symbol class multiplies it once. If you have to pick one, go longer.
• 16+ characters for anything valuable — email, password manager, cloud console, banking, SSH.
• 20+ characters for service accounts, API credentials, and database users. Nobody types these, so length costs nothing.
• Turn symbols off when a password will be typed on a mobile keyboard or read aloud, and add two or three characters to compensate. A slightly longer alphanumeric password is stronger in practice than a shorter symbol-laden one you get wrong twice before giving up.
• Check the target's rules first. Systems that silently truncate at 16 characters or reject certain symbols are still common, and a truncated password that no longer matches what your manager stored is a bad afternoon.

Using Generated Passwords Well

• One password per account, always. Reuse is what turns one unrelated site's breach into a compromise of your email. Credential-stuffing attacks replay leaked pairs across hundreds of services automatically.
• Store them in a password manager. Random passwords are unmemorable by design — that is the point. The manager remembers them; you remember one strong passphrase.
• Turn on multi-factor authentication anyway. A strong password defeats guessing, not phishing or malware. MFA covers what it cannot.
• Rotate on evidence, not on a calendar. Current NIST guidance (SP 800-63B) explicitly recommends against forced periodic rotation, which mostly produces predictable increments. Change a password when there is a reason to.
• Never paste a live password into a tool you have not checked. That includes this one — the difference is you can verify it. Open your network panel and watch: no request is made, because the page has no server to call.

Passwords You Actually Have to Remember

For the handful you must type from memory — your device login and your password manager's master password — a random string is the wrong shape. Use a passphrase instead: five or six words chosen at random from a large word list. Six random words carry roughly 77 bits of entropy, comparable to a 12-character random password, and are far easier to recall and type. The critical part is that the words are chosen at random, not written by you.

Related Tools

Need to verify a file rather than protect an account? The Hash Generator produces SHA-256 and SHA-512 digests. Debugging an auth flow instead? The JWT Decoder shows exactly what claims a bearer token carries and when it expires.