What is entropy and why does it matter?

Entropy measures unpredictability in bits. Each additional bit doubles the number of guesses an attacker must make. A password with 40 bits of entropy is weak; 80 bits is strong for most purposes; 100+ bits is beyond the reach of any practical attacker. The tool computes entropy as length × log2(poolSize) — the theoretical maximum for a randomly generated password from that pool.

How accurate are the crack time estimates?

The estimates assume a brute-force attack that tries every possible password in the pool. They're useful for comparing password strengths but optimistic in practice — real attackers use dictionary attacks, pattern analysis, and leaked-password databases. Since these passwords are randomly generated with no patterns, the brute-force estimate is accurate. For human-chosen passwords, actual crack times are often far shorter.

Should I exclude ambiguous characters?

Enable it if you'll be manually typing the password, reading it aloud, or writing it down. It removes characters like 0/O, 1/l/I, 5/S, 2/Z, 8/B that are easily confused. It slightly reduces the pool size (and therefore entropy), but the practical usability gain usually outweighs the small entropy loss. For passwords stored only in a manager, leave it off.

What password length should I use?

For online accounts (email, social media): 16 characters minimum. For high-value accounts (banking, primary email, crypto wallets): 20+ characters. For master passwords that protect other passwords: 24+ characters. Modern guidance emphasizes length over complexity — a 24-character password with only lowercase letters is stronger than an 8-character password with every symbol.

Does the tool store or transmit my password?

No. The password is generated entirely in your browser using crypto.getRandomValues(). It is never sent to a server, never logged, and never persisted anywhere. When you close or refresh the page, the password is gone unless you saved it yourself.

Are the passwords safe to use for real accounts?

Yes. crypto.getRandomValues() is a certified CSPRNG (cryptographically secure pseudo-random number generator) suitable for cryptographic key generation. The passwords this tool produces are indistinguishable from truly random strings. As always, store them in a trusted password manager and never reuse across accounts.

Why can't I disable all character sets?

At least one set must be active to produce a password. If you could disable them all, the generator would have no characters to draw from. The UI automatically prevents this — clicking the last active toggle has no effect.

Why are symbols important?

Adding symbols increases the pool size from 62 (letters + numbers) to 94 characters — a 52% increase. In entropy terms, each character contributes log2(94) ≈ 6.55 bits versus log2(62) ≈ 5.95 bits. Over 20 characters, that's a difference of 12 bits — a 4,000× increase in the search space. Symbols are worth enabling unless a specific site prohibits them.

Ad Slot — Header Banner

CSPRNG · Entropy Analysis · 100% Private

Secure Password Generator & Entropy Analyzer

Generate truly random passwords using the Web Crypto API — the same cryptographic primitives your browser uses for HTTPS. Adjust length and character sets, optionally exclude ambiguous characters, and see real-time entropy analysis with estimated crack times. Nothing is transmitted.

#CSPRNG#Entropy#AES-grade#Offline#Private#Free

Your generated password

Options

Length20

664128

Include

Exclude ambiguous characters

Removes 0, O, 1, l, I, 5, S, 2, Z, 8, B

Entropy0 bits

Very weakPool: unique characters

Estimated crack time

Average-case times (half the keyspace). Assumes brute-force attack against the exact character pool.

Online attack (throttled)

less than a second

Offline attack (fast hash)

less than a second

Offline attack (slow hash)

less than a second

Nation-state cluster

less than a second

Ad Slot — Below the Fold

How to generate a secure password in 3 steps

Cryptographically random, never transmitted.

Set the length

Slide between 6 and 128 characters. For online accounts, 16+ is recommended; for master passwords, 20+ with all character sets. Longer is always stronger — a 20-char password is vastly more secure than an 8-char one.

Choose character sets

Toggle uppercase, lowercase, numbers, and symbols. At least one set must remain on. Enable 'Exclude ambiguous' if you'll be typing the password by hand or reading it aloud — it removes easily confused characters like 0 and O, 1 and l.

Copy and store safely

Click Copy to grab the password. Paste it into a password manager immediately — this is the safest place. Refresh regenerates a new password; your options stay. Never store passwords in plain text files.

Frequently Asked Questions

Fully cryptographically random. The generator uses the Web Crypto API's crypto.getRandomValues(), which is the browser's CSPRNG (cryptographically secure pseudo-random number generator). This is the same source of randomness used for HTTPS session keys and is considered suitable for cryptographic applications.

About the Secure Password Generator

Everything you need to know

Why browser-based password generation is safer

Server-based password generators transmit your chosen options and receive the generated password back over the network. Even with HTTPS, that means the password exists in server memory at least momentarily — a theoretical exposure risk. This tool generates passwords entirely in your browser using crypto.getRandomValues(), the same cryptographic primitive that protects your bank's HTTPS connection. Nothing is sent, nothing is logged, nothing is stored.

Understanding password entropy

Entropy is measured in bits and represents the number of random choices an attacker must guess. A password drawn uniformly from a pool of N characters at length L has entropy L × log2(N) bits. For example, a 12-character password from a 62-character pool (letters + numbers) has 12 × 5.95 ≈ 71 bits of entropy. Doubling the length doubles the entropy; doubling the pool size adds ~1 bit per character. This is why length matters more than complexity — but both help.

How crack-time estimates work

Brute-force attacks try each possible password in sequence until they find the right one. On average, they succeed after searching half the keyspace. Given a password's entropy E (in bits) and an attacker's guess rate R (in guesses per second), the average time to crack is 2^(E−1) / R seconds. The tool shows four attacker models: a throttled online attacker (10^3 guesses/sec), a nation-state cluster (10^14 guesses/sec), and two offline scenarios spanning slow hashing (10^4) to fast GPU-accelerated hashing (10^11). The gap between online and offline attackers is often 10+ orders of magnitude — which is why online account security depends far more on rate limiting than on password strength alone.

Best practices for password management

Use a unique password for every account — reuse is the single biggest password risk. Store passwords in a reputable password manager (Bitwarden, 1Password, KeePassXC, or your browser's built-in manager). Enable two-factor authentication wherever possible. Never share passwords over email, chat, or SMS. Rotate passwords immediately if a service you use reports a breach. For high-value accounts (primary email, banking, crypto), use passwords of 24+ characters — the extra length costs you nothing if you're using a manager, and it dramatically increases the search space.