🔒 Security Crypto API

Password Generator

Generate strong, cryptographically random passwords using your browser's Web Crypto API. Custom length, character sets, strength meter and bulk generation. Nothing is stored or sent anywhere.

Length: 16 characters

43264128

Character Sets

Uppercase

A B C D E F ... Z

Lowercase

a b c d e f ... z

Numbers

0 1 2 3 4 5 6 7 8 9

Symbols

! @ # $ % ^ & * - _ +

Exclude ambiguous

0 O l I 1 (hard to read)

Bulk Generation

Count

Separator

🔑

Your password will appear here

Configure settings and click Generate, or it will auto-generate when you load the page.

Password Security: What the Numbers Mean

Entropy measures unpredictability in bits. Each additional bit doubles the number of possible passwords. A password with 60 bits of entropy has over 1 quadrillion possible values.

Entropy	Strength	Offline Crack Time (100B/s)	Recommended For
Below 40 bits	Weak	Seconds to hours	Nothing important
40 to 60 bits	Fair	Hours to weeks	Low-value accounts
60 to 80 bits	Strong	Years to centuries	Most accounts
80 to 100 bits	Very Strong	Millions of years	Financial, email
100+ bits	Unbreakable	Heat death of universe	Highest security

Password Security Best Practices

Length beats complexity: A 20-character lowercase-only password has more entropy than a 10-character mix of all character types. Length is the single most important factor.

Use a password manager: Bitwarden (free, open source), 1Password or Dashlane let you use a unique, random password on every site without memorising any of them.

Never reuse passwords: When any site is breached, attackers try your credentials everywhere. One reused password can compromise all your accounts.

Enable two-factor authentication (2FA): A strong password plus a TOTP code (Google Authenticator, Authy) or hardware key (YubiKey) makes account takeover nearly impossible.

Privacy guarantee: All passwords are generated locally using window.crypto.getRandomValues() - the same API used by banks and security software. Nothing is stored, transmitted or logged.