Why Use This Tool?
Weak passwords are behind most account breaches — and 'correct horse battery staple' style passphrases only help if the randomness is real. This generator draws from your browser's cryptographic source with adjustable length and character sets, and guarantees at least one character from every set you select.
The entropy meter converts length and pool size into bits of security, so you can see exactly how strong each password is — and the ambiguous-character option removes look-alikes (O/0, l/1) for passwords you'll type by hand.
How It Works
- Set the length and tick your character sets.
- Optionally exclude ambiguous characters for hand-typing.
- Generate, check the entropy rating, and copy — then store it in a password manager.
What Is a Cryptographically Secure Password??
A secure password needs two things: enough length to resist brute force, and genuine randomness to resist pattern attacks. This generator draws from crypto.getRandomValues — the browser's cryptographically secure source — and guarantees at least one character from every selected set.
Common Use Cases
- New account credentials
- WiFi and router passwords
- API keys and dev secrets
- Password manager master passwords
The Entropy Meter
Entropy in bits = length × log2(character pool size). A 16-character password from a 90-character pool carries about 104 bits — beyond any practical brute-force reach. The meter computes this from your settings, not from vibes.
Length vs Complexity
A 20-character lowercase password (94 bits) beats an 8-character full-set password (52 bits). Length wins over complexity — but combining both is how you reach the 100-bit range where brute force becomes fiction.
Frequently Asked Questions
How long should a password be?
16 characters with all four sets gives roughly 100 bits of entropy — beyond practical brute-force reach. 12 characters is the minimum for anything you care about; go longer for accounts without two-factor authentication.
What is entropy in a password?
Entropy measures guessability in bits: each character adds log2(pool size) bits. A 16-character password from a 90-character pool carries about 104 bits — infeasible to brute-force.
Why exclude ambiguous characters?
O/0, l/1 and I/l look identical in many fonts. Excluding them helps when you'll type the password by hand — at a small cost in pool size.
Are these passwords sent anywhere?
No — generation uses your browser's cryptographic random source. The passwords never leave your device.
Tips & Things to Watch
- Store passwords in a password manager, never in plain text files.
- Longer beats complex: a 20-character lowercase password out-entropies an 8-character symbol soup.
- Enable two-factor authentication — a strong password is half the lock.
- Every generated password includes at least one character from each selected set.