Secure Password Generator

How this works

Most “random” password generators online lean on JavaScript's Math.random(), which is fast but predictable enough that it was never meant for anything security-related. This one uses the Web Crypto API instead, the same source of randomness browsers use internally, and picks each character with rejection sampling so the selection stays unbiased. It also guarantees at least one character from every type you've enabled, so turning on symbols doesn't just mean “maybe you'll get one” — you always will.

FAQ

Is this actually secure, or just random-looking?

It uses the Web Crypto API's crypto.getRandomValues() — the same cryptographically secure random number source browsers use for things like generating encryption keys — instead of Math.random(), which is not designed to be unpredictable. Every character position is also unbiased: indexes are picked with rejection sampling so no character is subtly more likely than another.

Does the password ever leave my browser?

No. Generation, the strength calculation, and the copy-to-clipboard action all happen locally in JavaScript — nothing is sent to this site's server or anywhere else. You could disconnect from the internet after the page loads and it would still work.

What does "bits of entropy" mean?

It's a measure of how many possible passwords could have been generated with your chosen settings — each extra bit doubles that number. Above roughly 60 bits is considered strong for most purposes, and above 80 is very strong. Length matters more than variety: a longer password with fewer character types often beats a short one with all four.

How is "time to crack" calculated?

It's a rough, illustrative estimate: it assumes an attacker guessing offline at 10 billion attempts per second — a reasonable stand-in for a fast attack against a weakly-hashed password — and takes half the total keyspace as the average case. Real-world time depends entirely on how whatever service you use stores the password, which you have no control over, so treat this as a way to compare settings, not a literal forecast.

Why exclude "ambiguous" characters?

Characters like lowercase l, uppercase I, and the number 1 (or capital O and zero) look nearly identical in many fonts. If you'll ever need to read this password aloud or type it from a printout, excluding them trades a small amount of entropy for a password you're less likely to mistype.