Password Generator

How Does the Formula Work?

The password generator creates cryptographically random passwords using the Web Crypto API built into your browser. It supports customizable length and character types, with a real-time strength meter that evaluates each password's entropy — the mathematical measure of randomness that determines how hard a password is to crack.

Why Length Matters Most

Every additional character multiplies the number of possible passwords by the charset size. A 12-character password with all types has 88¹² possibilities (about 10²³). A 16-character password has 88¹⁶ (about 10³¹) — that is 100 million times more combinations. Going from 12 to 16 characters is far more effective than adding a few special characters to a short password.

Strength Levels

The strength meter uses entropy to classify passwords. Below 36 bits is weak (crackable in seconds to minutes). 36–50 bits is fair. 50–65 bits is good for low-value accounts. 65–85 bits is strong for most purposes. Above 85 bits is very strong — even nation-state attackers with vast computing power would need astronomical time to crack it. For reference, a 16-character password with all character types has about 103 bits of entropy.

Complete Privacy

This generator runs entirely in your browser using JavaScript. The passwords are created using crypto.getRandomValues(), the same cryptographic random number generator used by professional password managers. No password, no seed, no data of any kind is ever sent to any server. When you refresh or close the page, the password is permanently gone from memory. You are the only person who can ever see the passwords this tool generates.

Why Length Matters More Than Complexity

A 12-character password using only lowercase letters has more entropy (56 bits) than an 8-character password using all character types (52 bits). Each additional character multiplies the search space exponentially, while adding special characters only increases it linearly per position. Security experts now recommend passphrases — long strings of random words like "correct-horse-battery-staple" — because they are both harder to crack and easier to remember. The generator supports lengths up to 128 characters for maximum security.

Common Password Attacks

Brute-force attacks try every possible combination sequentially. Dictionary attacks use common words and patterns. Rainbow table attacks use precomputed hashes. A strong random password defeats all three: brute-force becomes impractical above 80 bits of entropy (would take billions of years), dictionary attacks fail because the password contains no real words, and rainbow tables cannot cover the full space of long random strings. The crack time estimate in this generator assumes a modern GPU cluster performing 10 billion guesses per second.