Strong Password Generator

The Difference Between a Guessable and an Uncrackable Password

"Password123" gets cracked in under a second. "Fluffy2019!" in a dictionary attack — seconds. Your dog's name with your birth year — seconds. Any of those methods the average person uses to "make it memorable" are exactly what automated password-cracking tools are optimised to try first.

A cryptographically random password — one where each character is independently chosen from a character pool with no pattern — gives attackers nothing to work from. This generator creates exactly that. Every click produces a new password chosen with your browser's cryptographic random number generator. Your password never leaves your device.

How the Generator Works Under the Hood

Cryptographic randomness — not Math.random()

The Web Crypto API's crypto.getRandomValues() is used to generate each character index:

const array = new Uint32Array(length);
crypto.getRandomValues(array);
const password = Array.from(array, n => charset[n % charset.length]).join('');

This is a CSPRNG (Cryptographically Secure Pseudo-Random Number Generator). It draws from your operating system's entropy pool — hardware noise, timing jitter, interrupt randomness — not a predictable mathematical sequence. Math.random() is explicitly not used because it is deterministic and can be predicted if the seed is known.

Entropy — the real measure of password strength

Entropy (bits) = log₂(charset_size) × password_length

At 10 billion guesses per second (world-class GPU cluster), 104 bits of entropy would take approximately 3 × 10¹³ years to brute-force. By comparison, an 8-character all-alpha password has ~38 bits — crackable in minutes with modern hardware.

Recommended Settings by Use Case