Password Generator

About the Password Generator

This Password Generator produces cryptographically secure passwords using the Web Crypto API’s crypto.getRandomValues() function. Each character is drawn from a CSPRNG seeded by your operating system’s kernel entropy pool — /dev/urandom on Linux, BCryptGenRandom on Windows, SecRandomCopyBytes on macOS and iOS — the same source your browser uses to negotiate TLS session keys and generate ECDSA signing nonces. It is the strongest entropy source available to a web page.

NIST Special Publication 800-63B, revised in 2020, reversed decades of misguided password policy. The old composition rules requiring uppercase, digits, and symbols pushed users toward predictable patterns like Summer2024! and inflated help-desk reset calls without improving security. The current standard (NIST SP 800-63B §5.1.1.1) drops mandatory complexity and instead requires a minimum of 8 characters, with 15+ recommended for elevated-risk accounts. Each additional character multiplies brute-force cost by the alphabet size, so length scales exponentially while complexity scales only linearly.

The generator runs entirely client-side. No network request is made, no cookie is set, and no analytics event records the generated value. You can verify this in your browser’s DevTools Network tab while generating. Pair the output with a password manager such as Bitwarden, 1Password, or KeePassXC so you only need to memorize one strong master passphrase.

How It Works

For each character position, the code requests one 32-bit unsigned integer from crypto.getRandomValues(new Uint32Array(len)) and reduces it modulo the alphabet size. Naive modulo reduction introduces a small bias when 2³² is not evenly divisible by the alphabet length — for a 94-character alphabet the bias is roughly 1 in 45 million per draw, which is negligible for password strength and far below the bias introduced by users picking their own passwords.

Entropy is computed as length × log2(charset_size), the Shannon entropy of a uniform random draw. A 16-character password using all 94 printable ASCII characters yields 16 × log2(94) ≈ 16 × 6.5546 ≈ 104.9 bits. NIST SP 800-63A considers 80 bits the floor for ‘computationally infeasible’ brute force against commodity hardware through roughly 2030; 128 bits is the ceiling considered resistant to large-scale quantum attacks on symmetric primitives.

The strength rating maps 30+ bits to Weak, 50+ to Moderate, 70+ to Strong, and 100+ to Very Strong. Crack-time estimates assume an offline attack against a fast hash such as SHA-256 at 10¹⁰ guesses per second — roughly the throughput of one RTX 4090 against bcrypt at cost factor 5. Real services use slower KDFs (Argon2id, scrypt, bcrypt at cost 12+) that raise the cost by 1,000 to 100,000×, but attackers also use larger botnets, so the estimate is deliberately conservative.

The optional ‘exclude look-alikes’ filter drops 0 O 1 l I from the alphabet. This is a usability feature for typing passwords manually or reading them over the phone — not a security one. Entropy drops by roughly 1 bit per character because the alphabet shrinks from 94 to 89.

Worked Examples

With all four character classes enabled and length 16, a typical output is K7#mP2$vR8!nQ9&b. Alphabet size = 94, entropy = 16 × log2(94) ≈ 105 bits. At 10¹⁰ guesses per second, offline crack time is 2104 / 1010 ≈ 2 × 1021 seconds ≈ 63 trillion years — comfortably longer than the age of the universe (4.3 × 10¹⁷ seconds).

Drop the length to 8 with the same alphabet and entropy collapses to 8 × log2(94) ≈ 52 bits, crackable in 251 / 1010 ≈ 6.5 hours on one GPU. That gap is the practical difference between ‘effectively unbreakable’ and ‘toast by lunchtime.’

For a 20-character lowercase passphrase (no symbols), output like mgtukrephwnsfjqloiza yields 20 × log2(26) ≈ 94 bits — still uncrackable this century, and easier to type into YAML configs, terminals, and QR-encoded Wi-Fi cards where $ % & would otherwise be misinterpreted.

When to Use This Tool

• Generating unique per-site passwords when migrating to Bitwarden, 1Password, or KeePassXC.
• Creating a master passphrase for your password vault — use 20+ characters with full charset for 128-bit entropy.
• Rotating the root password for a database, SSH user, or router on a quarterly cadence.
• Generating API tokens for service-to-service authentication (treat as long-lived secrets, rotate every 90 days).
• Setting a WPA2/WPA3 Wi-Fi password resistant to dictionary attacks on captured 4-way handshakes.
• Producing one-time encryption passphrases for VeraCrypt containers or GPG file encryption.
• Demonstrating brute-force vs. length trade-offs in security-awareness training and CTF challenges.

Limitations & Disclaimer

This tool generates passwords using the Web Crypto API’s CSPRNG and reports entropy based on character-set size and length. It does not protect against phishing, credential stuffing, keyloggers, or server-side breaches — those threats require password managers, hardware security keys (FIDO2/WebAuthn), and breach-monitoring services. Entropy estimates assume uniform distribution and brute-force attacks; targeted dictionary attacks using leaked-password lists (RockYou, Collection #1, Cit0Day) crack low-entropy human-chosen passwords far faster. See our disclaimer for full terms.

Frequently Asked Questions

Last updated: September 9, 2026  ·  Author: HT99 Tools Editorial Team