Password generator
Strong random passwords from the browser's cryptographic generator.
Result
The result will appear here.Generates passwords from crypto.getRandomValues, the browser's cryptographically secure source of randomness, rather than Math.random — which is predictable and has no place anywhere near a credential. Each candidate is shown with the entropy it actually carries, so you can see what length buys you rather than guessing.
How it works
- Randomness comes from the operating system through WebCrypto, and the selection is rejection-sampled so every character in the alphabet is equally likely.
- Entropy is computed from the alphabet size and the length, and shown in bits.
- Nothing is transmitted or stored — the passwords exist only in the page.
Where your data goes
Nowhere. This tool runs entirely in your browser: the text you paste is processed by the page and is never transmitted to a server or written to a log.
This tool handles keys and credentials, so nothing about a run is saved, not even to your own history.
What it costs
This tool is free, with no sign-in and no points.
Common questions
- How long should a password be?
- For anything protected by a password manager, 20 characters of mixed alphabet is far past the point where guessing is the weak link. For something you have to type, a longer passphrase of ordinary words is easier to type and just as strong.
- What does the entropy figure mean?
- It is how many bits of guessing an attacker faces, assuming they know exactly how the password was generated. Each extra bit doubles the work. Below about 60 bits is guessable by a well-resourced attacker; above 80 is not.
- Why exclude ambiguous characters?
- Because 0/O and 1/l/I get misread when a password has to be read aloud or copied off a screen. It costs a little entropy, which the length can make back.
The open-source behind it
This tool is a self-contained implementation. dropbox/zxcvbn (MIT) does the same job as a library — if you need this behaviour inside your own program, start there rather than calling a web page.
dropbox/zxcvbnAlso known as
- password generator
- random password
- strong password generator
- secure password online