Strong Password Generator
Generate cryptographically random passwords with adjustable length and character sets. Entropy estimate included. Nothing is stored or sent anywhere.
Password strength comes from length, not symbols
The single most effective way to make a password strong is to make it long. Each extra character multiplies the number of possible passwords an attacker must try.
| Length | 62-character alphabet | Time to crack (offline, fast GPU) |
|---|---|---|
| 8 | 2.2×10¹⁴ | seconds |
| 12 | 2.3×10²¹ | years |
| 16 | 2.8×10²⁸ | millennia |
| 20 | 3.5×10³⁵ | astronomically long |
The math behind the entropy estimate
Entropy is measured in bits. For a password of length L drawn randomly from a set of N possible characters, the entropy is:
entropy = L x log2(N)For a 16-character password using all 62 letters, digits and symbols, that works out to about 95 bits — comfortably above the 80-bit threshold commonly cited for strong passwords.
What the tool does differently
Passwords are generated with crypto.getRandomValues(), the browser's cryptographically secure random number generator. Many online generators use Math.random(), which is fast but predictable and should never be used for secrets.
Practical advice
- Use a password manager. Let it generate and store long random passwords for you.
- Never reuse a password. Reuse is what turns one breach into a hundred.
- Enable two-factor authentication wherever it is offered.
- Do not rotate passwords on a schedule unless a breach occurred — length beats rotation.
Related
Need to store a secret safely? Use the hash generator to create a SHA-256 digest of a value you need to verify later.
Frequently asked questions
Is the password sent anywhere?
No. It is generated with crypto.getRandomValues(), the browser's cryptographically secure random source, and displayed directly. It is never transmitted or logged.
How long should my password be?
At least 16 characters. Length matters far more than symbol variety — a 20-character passphrase is both stronger and easier to remember than P@ssw0rd!.
Is this safe to use for a bank account?
Yes, provided the browser itself is up to date and you are not on a shared or compromised machine. The randomness source is cryptographically secure.
Why do the characters look random rather than word-based?
Random strings maximise entropy per character. If you prefer a memorable passphrase, use four or five unrelated words instead.
Should I change my password every few months?
No, not unless there has been a breach. Guidance has moved towards changing passwords only when reuse or compromise is suspected, and prioritising length and MFA.