Password Generator
Create strong, cryptographically random passwords and passphrases. Generated entirely in your browser — nothing is ever sent anywhere.
Generated Password
Options
What makes a password strong?
Password strength comes down to entropy — how many possible combinations an attacker would have to try before guessing correctly. Length matters more than complexity: a 20-character password using only lowercase letters is often stronger than an 8-character password mixing everything, simply because there are more possible combinations to search through.
Random characters vs. passphrases
Random character passwords maximize entropy per character and are ideal when paired with a password manager, since you won't need to type or remember them. Passphrases — a sequence of random words like river-Cactus-Bridge42 — trade a little entropy for memorability, which matters for passwords you do need to type or recall, like a device passcode or master password.
Why Math.random() isn't safe for passwords
Many password generators online use JavaScript's Math.random(), which is a fast but predictable pseudo-random number generator — not designed for security. This tool uses the Web Crypto API's crypto.getRandomValues(), which draws from your operating system's cryptographically secure random source.
Frequently Asked Questions
Is this password generator secure?
Yes. It uses the Web Crypto API (crypto.getRandomValues), which is cryptographically secure and unpredictable — unlike Math.random(), which is not safe for generating passwords. Everything runs locally in your browser; nothing is ever transmitted or logged.
How long should my password be?
Most security guidelines recommend at least 12–16 characters for standalone passwords. Longer passwords combined with a password manager are the strongest defense, since length contributes more to brute-force resistance than complexity alone.
What is a passphrase and is it more secure than a password?
A passphrase is a sequence of random words, such as correct-horse-battery-staple. Passphrases can be easier to remember than random characters while still providing strong entropy, especially with 4 or more random words from a large wordlist.
Does this tool store or send my generated passwords anywhere?
No. Password generation happens entirely client-side in your browser using JavaScript. No password is ever sent to a server, logged, or stored in any database.