Password Generator

A password only has to survive one thing: an attacker who has stolen a database of password hashes and is guessing offline, as fast as their hardware allows. That attacker does not type guesses into a login form, so rate limits do not help. What helps is length and genuine randomness, which is exactly what this generator produces.

Every password here is built from your browser's cryptographic random number generator, the same source used for encryption keys. That matters more than it sounds: the ordinary random function available to web pages is a predictable algorithm, and passwords built from it can be reproduced by anyone who works out its state. The character at each position is also chosen without bias, so no character is quietly more likely than another.

The strength meter shows entropy in bits, which is the honest measure for a randomly generated password: it is the size of the space an attacker has to search. Adding one character to a mixed-case password with numbers and symbols multiplies that space by about eighty. Adding a whole extra character type barely moves it. That is why the length slider does far more for you than the checkboxes do.

Nothing is transmitted and nothing is stored. The password appears on this page and exists nowhere else, so there is no server log, no history and no copy of it anywhere but your clipboard.