Secure Password Generator
Generate cryptographically random passwords using your browser's Web Crypto API. Customize length and character types. Nothing is sent to any server.
Why Cryptographic Randomness Matters
This generator uses the browser's Web Crypto API (crypto.getRandomValues()), which draws entropy from the operating system's cryptographically secure random number generator. The difference matters: JavaScript's Math.random() is a pseudo-random number generator — its output is deterministic and predictable if an attacker knows the seed. A CSPRNG is computationally infeasible to predict. For passwords protecting real accounts, only CSPRNG-generated passwords should be used.
Length Beats Complexity
A 12-character password using only lowercase letters has 26¹² ≈ 95 trillion possible combinations. Adding uppercase, digits, and symbols to 8 characters gives about 6 trillion combinations — significantly fewer. Length compounds exponentially while character set expansion multiplies linearly. For most purposes, a random 16-character password from a full character set is essentially uncrackable with current hardware. At 20+ characters with full character sets, even future computing advances pose no practical threat.
How Attackers Crack Passwords
Brute force tries every possible combination — effective only against short passwords. Dictionary attacks use wordlists of common passwords, names, and phrases, often with substitutions (p@ssw0rd, 1etmein). Credential stuffing takes usernames and passwords from one data breach and tries them on other services — which is why reusing passwords across sites is dangerous regardless of their strength. A strong, unique password generated here defeats all three attack types simultaneously.
Storing Passwords Safely
A strong generated password is only useful if you can store and retrieve it. Use a password manager — Bitwarden (open source, free), 1Password, or similar — to store one unique password per site. The password manager itself needs one strong master password, which is the only one you need to memorise. Enable two-factor authentication on the password manager and on any account that supports it. Never store passwords in browser autofill if you share a device.