Passwords a computer can't guess and you don't have to invent
Every leaked-password study finds the same rubble: 123456, qwerty, a pet's name with a birth year. Humans are spectacularly bad at inventing randomness — we reach for patterns, and patterns are exactly what cracking software eats first. This generator inverts the job: your browser's cryptographic random source picks each character, you pick the rules (length, character sets, how many to generate), and a live entropy meter scores the result in the only currency that matters — bits.
How to generate passwords
- Set the length (16+ recommended) and tick the character sets to include.
- Optionally exclude look-alike characters (0/O, 1/l/I) for passwords someone might type from paper.
- Choose how many to generate and click Generate passwords.
- Check the entropy meter, then copy the batch.
What the entropy number means
Entropy measures how many guesses an attacker needs: each added bit doubles the search space. The meter computes it from your settings — length × log₂(pool size). Rough map: under 40 bits is crackable on a laptop; 60 bits resists casual attack; 80+ bits is the modern recommendation; 100+ is overkill that costs you nothing here. The arithmetic teaches the big lesson: length beats complexity. A 20-character lowercase-only password (~94 bits) embarrasses an 8-character everything-soup (~52 bits). When a site allows long passwords, take the length.
Guaranteed variety, honest randomness
Two implementation details that separate real generators from toys: every password is drawn from crypto.getRandomValues() — the cryptographically secure source — never the predictable Math.random(); and each generated password is guaranteed to contain at least one character from every set you ticked (then shuffled), so “must include a number and a symbol” form validators never bounce you back.
Password hygiene beyond generation
- One password, one account. Reuse converts a single site's breach into a master key for your life — the actual mechanism behind most “hacks”.
- Use a password manager: generate here, store there, memorise only the vault's passphrase.
- The exclude-ambiguous option exists for the Wi-Fi-code-on-a-whiteboard scenario — skip it otherwise for maximum pool size.
- Batch mode (5–50 at once) suits admins provisioning accounts; assign sequentially, never reuse.
- Generated locally: passwords are minted in your browser's memory and appear nowhere else — no server, no log, no network trip.
Sixteen-plus characters, four character sets, 100 bits of indifference to every cracking wordlist on earth — generated faster than you can mistype “P@ssw0rd2026”.
Quick reference
| Property | Detail |
|---|---|
| Length | 6–64 characters (16+ recommended) |
| Character sets | Lowercase, uppercase, digits, symbols — combinable |
| Randomness | crypto.getRandomValues (CSPRNG) |
| Guarantee | ≥1 character from each selected set |
| Strength meter | Live entropy in bits (aim for 80+) |
| Batch | 1–50 passwords per run |
| Privacy | Generated locally, never transmitted |
Frequently asked questions
How long should my password actually be?
16 characters with mixed sets (~100 bits) comfortably exceeds the 80-bit modern recommendation and is the sensible default. For anything critical — email, banking, password manager vault — 20+ costs nothing when a manager does the remembering.
Is it safe to generate passwords on a website?
On this one, yes, verifiably by design: generation runs in your browser via the crypto API, nothing is sent anywhere, and the page works identically offline. (Generic advice stands: never use a generator that shows passwords after a server round-trip.)
What does “exclude ambiguous characters” do?
It removes 0/O and 1/l/I — pairs indistinguishable in many fonts — shrinking the pool slightly but eliminating transcription errors. Use it for passwords humans will read or type from paper; skip it for manager-stored ones.
Why does my bank reject these strong passwords?
Legacy systems sometimes cap length or ban certain symbols. Shorten to their maximum and drop symbols if required — at 16+ characters of mixed case and digits, the password remains far stronger than their minimums.