Secure Password Generator Strong Random Passwords With the Web Crypto API

What this generator does

This tool produces cryptographically random passwords and passphrases inside your browser. It uses the Web Crypto API that every modern browser ships, draws randomness from the operating system's cryptographically secure random number generator, and assembles the password from the character sets or word lists you select. Nothing is transmitted to a server, nothing is stored, and nothing is logged. If you want to verify the claim, load the page, disable your network connection, and press Generate. The tool continues to work because it does not need a server.

Two modes are supported. In password mode, the tool draws characters from the pools you enable, at the length you choose. In passphrase mode, it draws words from a fixed list and joins them into a readable phrase in the style popularised by the diceware method and the EFF wordlist. Both modes report an entropy estimate so you can compare settings against the strength you actually need.

If the AI insight button is pressed, only anonymous metadata is sent to a small serverless function that runs once and then stops. The mode, the length, the pool size, and the entropy estimate are shared. The password characters themselves are never included in that request, and neither is anything you typed into the password manager of your browser.

How entropy works

Entropy is a measure of unpredictability, expressed in bits. Every additional bit doubles the number of equally likely candidates an attacker has to try. A password with one hundred bits of entropy has two to the power of one hundred possible values, which is far beyond anything a realistic attack can enumerate. The formula for character-based passwords is simple.

If the pool is ninety-four characters, which is what you get when uppercase letters, lowercase letters, digits, and the common symbols are all included, then log₂(94) is about 6.55 bits per character. A sixteen-character password from that pool has about 105 bits of entropy. A twelve-character password from the same pool has about 78 bits. Doubling the length doubles the entropy; adding ten characters to the pool only adds about half a bit per character, which is why length dominates the calculation.

Passphrase entropy works differently. If the word list contains 7,776 words and every word is drawn independently, each word adds about 12.9 bits. A five-word phrase has about 64 bits, a six-word phrase has about 77 bits, and a seven-word phrase has about 90 bits. Those numbers are conservative because they assume the attacker knows the wordlist and the length, which is the correct assumption for any well-designed phrase generator.

Password length and character sets

Length is the single most important knob on the generator. Every extra character multiplies the number of possible values, and the effect compounds. A twelve-character password is exponentially weaker than a twenty-character password from the same pool, even though the two strings look similar. If a service lets you pick the length, pick the longest one it accepts and do not worry about memorising it, because a password manager can store it for you.

Character sets are the second knob. Each set you add expands the pool, which raises entropy at a given length. The full ninety-four-character set is uppercase, lowercase, digits, and the common symbols. Some services reject certain symbols, and some reject symbols entirely, in which case the honest answer is to generate a longer password rather than to edit a strong one into a predictable pattern. Editing a strong password by hand usually introduces structure that an attacker can model, which removes most of the benefit of the randomness in the first place.

The exclude-ambiguous option removes characters that look alike in many fonts, including zero and capital O, lowercase l and the digit one, and capital I and lowercase l. Excluding them makes the password easier to read aloud and to type by hand from a printed sheet or a second screen. The trade-off is a slightly smaller pool, which is easy to compensate for by adding one or two characters to the length.

Passphrases and when to use them

A passphrase is a sequence of random words joined into a readable string, such as sunny-harbour-basket-copper-mint. The idea is simple: humans remember words better than they remember random characters, so a long phrase made of random words is both easier to remember and harder to guess than a short string of random characters. The method traces back to the diceware approach, which uses physical dice to pick each word from a numbered list, and it is the recommended technique in most modern guidance for any password that has to be remembered rather than pasted.

Three practical rules make a passphrase strong. First, the words must be drawn at random from a large list, not chosen by you. A phrase made of words you liked is easier to guess than its length suggests, because the pool the attacker has to consider is much smaller than the official list size. Second, the phrase should be long enough. Five words is the practical minimum and six or seven is better for anything important. Third, the phrase should be unique. Do not reuse the same passphrase across accounts, for the same reason you would not reuse a password.

The generator draws from a fixed list of common English words that is included in the page, and it lets you choose the word count, whether to capitalise each word, whether to append a random number, and whether to join the words with hyphens. The hyphen option makes the phrase easier to read and to type, and the capitalisation option does the same at the cost of a very small amount of entropy, which the length more than compensates for. If you are generating a passphrase for someone who has to type it on a phone, the hyphen and capitalisation options are worth leaving on.

The case against password reuse

Reusing passwords is the most common single reason accounts get compromised. When a service suffers a data breach, the attacker usually gets a list of email addresses and password hashes, and if the hashing is weak, the plaintext passwords can often be recovered in bulk. Those pairs are then tested against other popular services in automated credential-stuffing attacks, which run twenty-four hours a day and require no particular skill to operate. A breach at a shopping site you visited once can hand an attacker the password to your email account, your bank, and your social profiles, if all of them share the same password.

The fix is a password manager, and the fix for the password manager is one strong password you do actually remember. Use this generator to create a unique password for every service you care about, store them in a password manager, and let the manager handle the remembering. The single password or passphrase that unlocks the manager is the only one you need to memorise, and this generator can produce that too, ideally in passphrase mode with a word count of six or more.

Storing and sharing safely

A strong password is only one part of account security. Multi-factor authentication, usually a time-based code from an authenticator app or a hardware key, is the second part and is worth enabling everywhere it is offered. A password manager is the third part, because it prevents the reuse that undermines the first two. Together, those three habits cover the vast majority of realistic account takeover scenarios.

Never send a password through a channel you would not want a third party to read. Email, SMS, and most chat applications are not end-to-end encrypted, and even when they are, the recipient's device may be compromised. If you must share a password with a colleague, use a password manager's built-in sharing feature, or send it through a channel that both of you control, and change it after the collaboration ends. If you suspect a password has leaked, change it immediately and enable multi-factor authentication if you have not already.

What the strength meter means

The strength meter estimates entropy from the pool size and the length, and it maps that estimate into five labels. The mapping is a rule of thumb, not a guarantee against every attack.

Entropy is not the only thing that matters. A password can be exposed through phishing, through a compromised device, through a data breach at the service that holds it, or through accidental sharing, no matter how many bits it has. The strength meter tells you how hard the password would be to guess from scratch; it does not protect against any of the other failure modes, and it should not be read as a guarantee that the account is safe.

Common mistakes

Editing a strong password into a memorable one. If you take a random string and change a few characters so you can remember it, you have removed most of the randomness. The result is usually far weaker than it looks. Generate a new password with the settings you actually want, and let a password manager store it.

Using the same password everywhere. The strength of an individual password does not matter much if the same one is used on a hundred services, because the weakest service in the set determines the security of the whole set. Unique passwords, one per account, stored in a manager, is the correct approach.

Choosing a short password because it looks random enough. Twelve random characters is weaker than sixteen, and sixteen is weaker than twenty-four. Length dominates the calculation, and the strongest choice that a service accepts is almost always the right one.

Disabling symbols on a service that accepts them. Adding symbols expands the pool, which increases entropy at a given length. If the service accepts them, include them. If it does not, add length instead of giving up.

Storing the password in a screenshot, a note, or a browser tab that stays open. The generated password is on screen until you close the tab. If you need to keep it, put it in a password manager immediately, and clear the page when you are done.

Sharing a password through email. Email is not a secure channel. If a password has to move between two people, use a password manager's sharing feature or a channel both parties control, and change the password after the collaboration ends.

Assuming MFA makes a weak password safe. Multi-factor authentication reduces the risk from a stolen password, but it does not eliminate it. Phishing kits that relay MFA codes are common, and account recovery flows often bypass MFA entirely. Use a strong unique password and MFA together.

Where this tool stops

This generator produces random strings and passphrases in your browser. It does not store them, does not synchronise them between devices, and does not audit the security of the sites you use them on. It does not check whether a password has appeared in a known breach, does not detect phishing pages that try to collect what you paste, and does not replace a password manager. Those responsibilities belong to the user and to the tools that handle storage and account security.

It also does not provide legal or professional advice on security compliance. Decisions about which standard to follow, which length to require, and which authentication factors to accept depend on the organisation, the industry, and the applicable regulations. The tool produces strong random output; the policy that determines how strong it needs to be belongs somewhere else.

What the tool does give you is a fast, transparent, private way to generate a password or passphrase that is genuinely random, with an honest estimate of its entropy and a clear statement of its limits. Used together with a password manager, multi-factor authentication, and the discipline of one password per account, it is a practical starting point for improving the security of everything you log into.