Strong Password Generator — Generate Secure Passwords Online
FreeGenerate cryptographically secure random passwords. Configurable length, character sets, and entropy display. Free, runs in your browser — passwords never transmitted.
What's next
Settings guide
Length:
- ·12 characters — Minimum for most security policies in 2026. Adequate for non-critical accounts when a password manager stores it.
- ·16 characters — Recommended default. Resistant to brute force with current and near-future hardware.
- ·20+ characters — High-security environments: root credentials, encryption keys, privileged service accounts.
Character sets:
- ·Uppercase (A–Z) — 26 characters
- ·Lowercase (a–z) — 26 characters
- ·Digits (0–9) — 10 characters
- ·**Symbols (!@#$%^&*...)** — ~32 characters
- ·All four sets enabled: 94-character alphabet. Each character adds log₂(94) ≈ 6.5 bits of entropy.
Entropy display: Entropy in bits is shown for the current settings. 128-bit entropy is the security target for most applications. 256-bit is used for encryption keys.
Format comparison
Random passwords vs passphrases: A 4-word passphrase (from a 7,776-word Diceware list) has 4 × log₂(7776) ≈ 51.7 bits of entropy — far less than a 16-character random password (~105 bits). Passphrases are more memorable; random passwords are more secure at equivalent character count. If a password manager stores it, maximum entropy wins — use a random password.
Browser generator vs password manager generator: Both use cryptographic randomness and produce equivalent security. The browser generator is useful when you do not have your password manager handy or need a password to create the master account for a new password manager.
How it works
Generate random bytes
The required number of random bytes are requested from window.crypto.getRandomValues() — a CSPRNG (Cryptographically Secure Pseudo-Random Number Generator) backed by the operating system's entropy pool.
Map bytes to characters
Each random byte is mapped to a character from the selected alphabet using rejection sampling — bytes that would create a biased distribution are discarded and a new random byte is used. This ensures uniform distribution across all characters.
Calculate entropy
Entropy in bits is calculated as length × log₂(alphabet size). Entropy indicates how hard the password is to brute-force: each bit of entropy doubles the search space.
Display and copy
The password is shown in a masked field (reveal toggle available). A one-click copy button copies to clipboard without selecting text. The password is never sent anywhere — it exists only in your browser tab.
About this format
A strong password is unpredictable. The most important factor is length — each additional character multiplies the number of possible passwords exponentially. A 20-character random password from a 94-character set has 94²⁰ ≈ 5.6 × 10³⁹ possibilities, making brute force infeasible.
This generator uses your browser's Web Crypto API (`crypto.getRandomValues()`) — the same cryptographic randomness source used for TLS keys. Passwords are generated and displayed locally; they are never transmitted, logged, or stored anywhere outside your browser tab.