Why Use a Password Generator?
Humans are terrible at creating random passwords. We gravitate toward patterns, dictionary words, and personal information — all of which make passwords easy to crack. A random password generator eliminates human bias, using cryptographically strong randomness to produce passwords that resist brute-force and dictionary attacks.
What Makes a Strong Password?
- Length over complexity: A 16-character lowercase password is harder to crack than an 8-character password with symbols. Length is the single biggest factor.
- Character variety: Mixing uppercase, numbers, and symbols adds entropy. Each additional character set multiplies the possible combinations.
- True randomness: Using
crypto.getRandomValues()— the same API behind most password managers — ensures unpredictability. - No patterns: Avoid keyboard walks (qwerty), repeated characters, and sequential numbers.
Recommended Settings by Use Case
| Use Case | Length | Charsets |
|---|---|---|
| General web accounts | 16+ | a-z, A-Z, 0-9, symbols |
| Banking / finance | 20+ | All charsets |
| Wi-Fi passwords | 20+ | All charsets |
| API keys / tokens | 32–64 | a-z, A-Z, 0-9 (no symbols) |
FAQ
Is the password sent to a server?
No. All generation happens locally using crypto.getRandomValues() in your browser. The password never leaves your device.
How random is it really?
We use the Web Crypto API's CSPRNG (cryptographically secure pseudorandom number generator), seeded by your operating system's entropy source. This is the same API used by major password managers.
Should I use this instead of a password manager?
This tool generates strong passwords, but a password manager also stores, syncs, and auto-fills them. For day-to-day use, combine both: generate here, save in your manager.
Why do some sites reject my password?
Some sites limit special characters or password length. If a generated password is rejected, try disabling symbols or reducing the length. Most sites accept 12–20 characters with letters and numbers only — still very strong with our CSPRNG-based generator.
How often should I change my passwords?
Modern guidance (NIST SP 800-63B) says change a password only when you suspect it's compromised — forced periodic changes just push people toward weaker, easier-to-remember passwords. But when you do rotate one, generate a fresh random password here instead of tweaking the old one.
Should I use a random password or a passphrase?
Both are strong, but they solve different problems. A random string (what this tool generates) is ideal for API keys, tokens, and accounts you'll save in a password manager — maximum entropy per character. A passphrase (4–5 random words, think "correct horse battery staple") is better when you must memorize it with no manager, like a disk-encryption key or master password. The rule of thumb: if you can use a manager, go random; if you must type it often or memorize it, a passphrase wins on usability.
How is the strength bar calculated?
It estimates entropy in two dimensions: length and character-set variety. Length dominates — a 20-character lowercase-only password has roughly 95 bits of entropy, which is more than a 12-character password with all four charsets (~76 bits). The bar uses the same mental model as zxcvbn-style estimators: longer and more varied = exponentially more combinations for an attacker to brute-force.