Why generate passwords locally?
A password generator that runs on a server has, by definition, seen your password. This one uses your browser's built-in cryptographic random number generator (crypto.getRandomValues) - the same engine your bank's website relies on - and everything happens on your device. You can load this page, disconnect from the internet, and it still works.
What makes a password strong in practice
- Length beats cleverness. A random 20-character password is astronomically stronger than a "clever" 10-character one. Each extra character multiplies the work an attacker must do.
- Random beats memorable. Humans are terrible randomness generators - patterns, dates and substitutions (p@ssw0rd) are the first things cracking tools try.
- Unique beats everything. The most common breach path is one reused password. Use a password manager and a different random password per site.
What the entropy number means
Entropy (in bits) measures how many guesses an attacker needs: every +1 bit doubles the work. As a rule of thumb, 80+ bits is strong for online accounts and 100+ bits is effectively uncrackable with current hardware.
Where the randomness comes from
Not all "random" is equal. This generator uses the browser's cryptographic random source - the same generator the browser uses for encryption keys - rather than the simple pseudo-random function scripts use for animations, which is predictable and unsafe for secrets. Just as important is what does not happen: the password is produced in your browser's memory and displayed, nothing more. There is no request to a server that could log it, which is a structural guarantee you cannot get from any generator that runs server-side, no matter what its privacy policy promises.
Practical policy that actually holds up
The threat model for most people is not a genius guessing their password - it is one leaked database being replayed against every other account. That makes reuse the cardinal sin and length the cheapest defense: a random 16-character password is beyond any realistic brute-force, and 20 characters adds margin for free since a password manager is typing it anyway. Generate a unique one per account, store them in a manager, and reserve your memory for the two that matter: the manager's master password and your email account, since email resets everything else.
Limitations to know
A perfect password does not help against phishing (you type it into a fake site yourself) or a compromised device - enable two-factor authentication on important accounts as the second layer. And some legacy sites cap length or ban symbols; the options here let you match their rules while keeping maximum entropy within them.
FAQ
Does this Password Generator send data to a server?
- No. No network request is involved in generating them - you can verify by watching the network tab of your browser's dev tools.
Is Math.random() used?
- No - that's not cryptographically safe. This tool uses
crypto.getRandomValues, with rejection sampling to avoid statistical bias. Should I exclude look-alike characters?
- If you'll ever read or type the password manually, yes. If it lives in a password manager, you can include them for a slightly larger character pool.