How Are Passwords Generated?
This tool uses the browser's crypto.getRandomValues() API, which provides cryptographically secure random numbers from the operating system's entropy source. This is the same source used by password managers and security tools — not the weaker Math.random() function. Your passwords are generated entirely in your browser and never leave your device.
Guaranteed Character Distribution
Unlike basic password generators that pick randomly from a combined pool (which can accidentally produce a password with no digits or no symbols), this tool guarantees a minimum number of characters from each selected charset. Use the +/− controls to set exactly how many uppercase, lowercase, digit, and symbol characters you need. The remaining positions are filled randomly from the combined pool, and the final result is shuffled using the Fisher-Yates algorithm so guaranteed characters don't cluster at the start.
What Makes a Strong Password?
- Length — The single most important factor. Each additional character multiplies the number of possibilities by the charset size.
- Character variety — Using uppercase, lowercase, digits, and symbols increases the charset size, multiplying entropy at each position.
- Randomness — Predictable patterns drastically reduce effective entropy even in long passwords.
Recommended Settings
- General accounts — 16 characters, all character types. ~100 bits of entropy.
- High-security accounts — 24+ characters for banking, email, and password manager master passwords.
- Readable passwords — Enable "Exclude ambiguous characters" to avoid 0/O, I/l/1 confusion when typing manually.
Frequently Asked Questions
Should I use this instead of a password manager?
Use both. Generate strong passwords here, then store them in a password manager like Bitwarden, 1Password, or KeePass. Never reuse passwords across accounts.
What is entropy and how much do I need?
Entropy (in bits) measures unpredictability. 80+ bits is secure for online accounts. 100+ bits is recommended for offline attack resistance. A 16-character password using all character types gives approximately 105 bits of entropy.
Is it safe to generate passwords in a browser?
Yes. This tool uses crypto.getRandomValues() — a cryptographically secure API — and performs all generation locally. No passwords are stored, logged, or transmitted.