password-generator
Generate cryptographically secure passwords or passphrases. See the entropy in bits so you know exactly how strong the result is. Everything is generated locally — nothing leaves your browser.
client-side only crypto.getRandomValues entropy display passphrase mode
options
password(s) at once (max 50)
generated
// what entropy in bits means
// password vs. passphrase
- Passwords are shorter but dense — random characters from a large character set. A 20-character random password with upper, lower, digits, and symbols has ~131 bits of entropy. Hard to type but impossible to memorize in any meaningful way without a password manager.
- Passphrases are longer but human-readable — random words from a dictionary. A 5-word passphrase from a 512-word list gives ~45 bits; from a 7776-word Diceware list it's ~65 bits. They're easier to type, easier to remember, and still very strong at 6–7 words. The trade-off: some systems have character limits that cut off long passphrases.
// why this uses crypto.getRandomValues
JavaScript's Math.random() is a pseudo-random number generator seeded from a predictable state — an attacker who knows enough about the environment can predict its output. crypto.getRandomValues() uses the operating system's cryptographically secure entropy source (the same source used for generating TLS keys). This tool uses crypto.getRandomValues() exclusively, with rejection sampling to avoid modulo bias.
Entropy measures how many guesses an attacker needs to crack your password. Each additional bit of entropy doubles the number of guesses. A password with 40 bits means roughly 1 trillion (2⁴⁰) possible values. With a modern GPU making ~10 billion guesses per second, 40 bits is cracked in about 2 minutes. At 80 bits it would take ~38,000 years on the same hardware. For anything important, aim for at least 80 bits of entropy.