Password Generator
Generate strong random passwords with the system random source, entirely in your browser.
What does this tool do?
Generates random passwords of the length you choose, with the character sets you choose, and tells you how much entropy the result actually has.
Two details that matter more than they look
The random source. The passwords come from crypto.getRandomValues, the browser’s
cryptographic generator. Math.random is faster and is not random enough for this: its output can
be predicted from previous values.
The sampling. Each character is drawn with rejection sampling rather than a modulo. Taking
value % alphabetLength makes the first characters of the alphabet slightly more likely than the
last, because the range of a 32-bit number is not a multiple of 94. The bias is small and it is
real, so it is not there.
At least one character from each set you enable is guaranteed, then the result is shuffled: a free draw over twelve characters can easily leave out the symbols, and plenty of sites insist on them.
Reading the number
Entropy in bits is length × log₂(alphabet size). Roughly: under 50 bits is weak, 80 bits is
fine for most accounts, 128 bits is beyond any brute force. A 16-character password with symbols
lands around 100 bits. If you need something you can type from memory, a longer password of plain
words beats a short pile of symbols.
Keep in mind
Nothing is stored, logged or sent anywhere: the passwords are generated in your browser and exist only on screen, so copy what you need before closing the tab. And if you are generating a password for a service you care about, a password manager is still a better answer than a good memory.