Generate a secure random password

This generator builds passwords using the Web Crypto API's crypto.getRandomValues(), a cryptographically secure random number generator built into every modern browser. Unlike Math.random() — which is fast but predictable enough that it should never be used for anything security-related — crypto.getRandomValues() produces output suitable for generating keys, tokens, and passwords. Every character is chosen client-side in your own browser; nothing you generate here is sent anywhere or logged.

Password strength is estimated using entropy, measured in bits: entropy = length × log2(pool size), where pool size is the number of distinct characters available based on which character sets you enable (uppercase, lowercase, numbers, symbols). A longer password drawn from a larger character pool has more possible combinations an attacker would have to try, which is what entropy quantifies. This tool labels the result Weak below 40 bits, Fair below 60, Strong below 80, and Very strong at 80 bits or above.

Length matters more than complexity for practical security. A 20-character password using only lowercase letters (about 94 bits of entropy) is dramatically harder to crack than an 8-character password crammed with symbols (roughly 52 bits), because entropy grows with the exponent (length), not just the base (pool size). If you have to choose between a longer simple password and a shorter complex one, choose length.

A password manager solves the actual problem passwords create: needing a long, random, unique password for every single account without memorizing any of them. Reusing even a strong password across multiple sites means that if one site suffers a data breach, every account using that password is now exposed too — this is the single most common way accounts get compromised, not brute-force guessing.

Avoid predictable patterns and substitutions like P@ssw0rd1 or Summer2024! — these follow rules that password-cracking tools already model, so they save far less entropy than they look like they should. A password generated with true randomness, at sufficient length, is both easier to reason about and harder to crack than a hand-crafted one that only looks complicated.