Passwords are generated using crypto.getRandomValues — the browser's cryptographically secure random number generator backed by the operating system's entropy pool. Each character is independently sampled from your selected character pool (lowercase, uppercase, digits, symbols). Strength is measured in bits of entropy: log2(poolSize) per character, multiplied by length. A 16-character password drawn from a 94-symbol pool delivers about 105 bits — enough to resist any brute-force attack with current or near-future hardware.


              entropyBits = length × log2(poolSize)
// 16 chars × log2(94) ≈ 105 bits — strong
// 8 chars  × log2(26) ≈ 38 bits  — weak

Common use cases

Creating new account passwords without reusing any existing one.
Rotating master passwords for password managers (1Password, Bitwarden) periodically.
Generating temporary credentials for shared accounts or one-off API integrations.

Frequently asked questions

Are these passwords actually random?

Yes — they use crypto.getRandomValues, which pulls from the operating system's cryptographic entropy pool (the same source used by HTTPS, SSH, and password managers). Math.random would not be safe; we never use it for password generation.

How long should a password be?

For a high-value account: at least 16 characters with all four character classes enabled (~105 bits of entropy). 12 characters all-classes is the practical minimum. Anything under 10 characters is breakable by modern GPU clusters in days.

Should I memorize these or store them?

Use a password manager. Strong random passwords are designed to resist guessing, which means they're equally hard for you to memorize. Vaults like 1Password, Bitwarden, or KeePass let you generate, store, and autofill them safely.

Does this tool log generated passwords?

No. Generation runs entirely in your browser tab and nothing is sent over the network. Once you close the page, the password is gone unless you copied it.

🔐 Password Generator

Related Tools

0 comments

How it works