Password generator
Strong random passwords generated on your device with the Web Crypto API. Pick a length and character sets; the entropy meter tells you exactly how strong the result is.
Pool: 89 characters. Brute-forcing half of it offline at 100 billion guesses a second would take far longer than the age of the universe.
How strong is a random password, really?
Strength isn’t about looking complicated. For a truly random password it’s just two numbers: how many symbols you choose from (the pool) and how many you pick (the length). Each symbol adds log₂(pool) bits of entropy, and every extra bit doubles the attacker’s work. Change them and watch.
- Possible passwords
- about 10^21
- Entropy
- 71.5 bits
- Online attack, 100 guesses/s
- 511 billion years
- Offline GPU rig, 100 billion/s
- 511 years
Times are the average to find a password by brute force (half the keyspace). A fast offline rate like 100 billion guesses per second applies to weakly hashed leaks such as unsalted MD5; bcrypt or Argon2 slow attackers by many orders of magnitude. The maths only holds if every symbol is picked at random. A human-chosen “P@ssw0rd!” has far less entropy than its length suggests.
What makes a generated password good
A password generator has one job: choose each character independently and uniformly from the pool. RandomKit uses the browser’s cryptographically secure generator and rejection sampling, so a 70-character pool gives each character exactly a 1-in-70 chance. There’s no pattern for an attacker to model.
NIST’s Digital Identity Guidelines (SP 800-63B) moved away from forced complexity rules and periodic resets. The advice now is: allow long passwords, check them against breach lists, and let people use password managers. A random 20-character password saved in a manager follows all of that.
Need something you can type or remember?
Try the passphrase generator. Six random words from the EFF list give about 77 bits of entropy, and they’re far easier to type on a phone or TV remote than a string of symbols.
Settings memory
Your length and character-set choices are saved in this browser’s local storage so the page opens the way you left it. Generated passwords are never saved. You can clear the settings on the privacy page.
Questions people ask
Is this password generator safe to use?
Yes. Passwords are generated inside your browser with crypto.getRandomValues, the cryptographically secure random source provided by your operating system. They are never sent over the network, logged or stored unless you choose to save settings.
How long should a password be?
NIST SP 800-63B requires at least 8 characters for user-chosen passwords and recommends allowing much longer ones. For a randomly generated password stored in a password manager, 16 or more characters from letters, digits and symbols gives over 100 bits of entropy, which is beyond any practical brute-force attack.
Do symbols make a password stronger?
A little per character: a 62-character pool gives about 5.95 bits per character and an 88-character pool about 6.46. Adding length helps more than adding symbol types, so if a site rejects symbols, add four or five characters instead.
What does “avoid look-alike characters” do?
It removes characters that are easy to confuse when reading or typing a password by hand, such as capital I, lowercase l, the digit 1, capital O and the digit 0. The entropy readout updates to reflect the smaller pool.
What is “require every selected set”?
Many sign-up forms demand at least one uppercase letter, digit and symbol. With this on, the generator guarantees one character from each set you ticked, then fills the rest at random and shuffles, so the rule is met without making the password predictable.