Introduction
Weak passwords cause over 80% of data breaches, according to Verizon's annual Data Breach Investigations Report. The problem is not that people do not care about security. The problem is that humans are bad at generating randomness. Ask someone to pick a random password and you get predictable patterns: a capital letter at the start, a number at the end, maybe an exclamation mark. Attackers know this. Our Password Generator uses the Web Crypto API to produce cryptographically secure passwords that no human would ever invent. Adjust the length and character sets, then copy the result. Everything runs in your browser. No password is transmitted or stored.
What this tool does
- Generates passwords using crypto.getRandomValues, the same CSPRNG used by TLS and WebAuthn.
- Configurable length from 4 to 64 characters with real-time entropy display in bits.
- Toggle uppercase, lowercase, numbers, and symbols independently.
- Exclude look-alike characters (i, l, 1, L, o, 0, O) for passwords that are easier to read and type.
- Exclude ambiguous punctuation ({ } [ ] ( ) / < > " ` ~ , ; : .) for systems that reject special characters.
How this tool works
The generator draws random values from the browser's CSPRNG via crypto.getRandomValues, which is specified in the Web Cryptography API (W3C). Each character position in the password is filled by selecting from the user's chosen character pool using a random index. The entropy estimate updates live as you change settings. For example, a 16-character password using all four character classes (94 possible characters) yields approximately 105 bits of entropy. The output regenerates automatically when you change any setting. Click "Generate New Password" for a fresh value.
How password entropy works
Password strength is a function of two variables: password length and the size of the character pool. The formula is:
H = L x log2(C)
where H is entropy in bits, L is length, and C is pool size.
| Configuration | Pool size | Length | Entropy | |---|---|---|---| | lowercase only | 26 | 12 | ~56 bits | | upper + lower + digits | 62 | 16 | ~95 bits | | all printable ASCII | 94 | 16 | ~105 bits | | all printable ASCII | 94 | 20 | ~131 bits |
NIST SP 800-63B recommends a minimum of 8 characters but notes that longer passwords provide exponentially more protection. A 20-character password with full ASCII has 131 bits of entropy, which is computationally infeasible to brute-force even at 10^12 guesses per second (roughly 10^21 years). The key insight from NIST: length matters more than forced complexity rules. A 20-character lowercase passphrase is stronger than a 10-character password with symbols.
The generator uses crypto.getRandomValues rather than Math.random because Math.random is not cryptographically secure. Its output can be predicted if an attacker can observe enough outputs. crypto.getRandomValues draws from the operating system's CSPRNG, which collects entropy from hardware sources.
How to use this tool
- Set the desired length using the slider. Longer is always stronger.
- Check or uncheck character classes: uppercase, lowercase, numbers, symbols.
- Optionally exclude look-alike or ambiguous characters for readability.
- Read the entropy estimate to understand the strength of the current configuration.
- Click Generate New Password and copy the result. Use it with a password manager for best results.
Real-world examples
Service account credentials
A DevOps engineer creates a service account for a CI/CD pipeline. The IAM policy requires passwords with at least 16 characters from all four character classes. Using the generator with length 24 and all options enabled, they get a password with ~157 bits of entropy. They store it in the team's vault (1Password, Bitwarden) and never type it manually.
Database connection string
A backend developer configures a PostgreSQL connection string for a production environment. The DBA requires a 32-character password with no ambiguous characters (because the connection string parser chokes on braces and quotes). They enable "Exclude ambiguous characters", set length to 32, and get a password like `K7mR9xVp2wQsN4hL6jYtF8bD3cG5aZ`. Entropy: ~191 bits.
Testing password strength checker
A QA engineer tests the Password Strength Checker tool. They generate passwords with various configurations: a 6-character lowercase password (weak), a 16-character full-ASCII password (strong), and a 24-character password with symbols excluded. They paste each into the strength checker to verify the entropy calculation matches.
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| Crypto random password | Low | Maximum entropy per character, no patterns |
| Passphrase (Diceware) | Low | Easier to memorize, longer for same entropy |
| Human-chosen password | Low | Convenient but predictable, low effective entropy |
Limitations or considerations
A strong password is only one layer of defense. If the service stores passwords in plaintext or weak hashes, your password strength does not matter. Always enable multi-factor authentication where available. This generator does not check for password reuse across services, nor does it verify that the target system accepts the character set you chose. Some legacy systems reject certain special characters or impose length limits below 64.
Frequently asked questions
Is crypto.getRandomValues truly random?
It is a CSPRNG seeded by the operating system's entropy pool. It is not deterministic in practice and is suitable for cryptographic key generation per the W3C Web Crypto specification.
What length should I choose?
Use at least 16 characters for general accounts. For high-value targets like password manager master passwords or root credentials, use 24 or more.
Should I include symbols?
Symbols add ~1.4 bits per character. They help if a service requires them, but length contributes far more entropy. A 20-character alphanumeric password is stronger than a 12-character password with symbols.
Can I use these passwords for a password manager?
Yes. Generate a long password (24+ characters) and store it in your manager. You only need to memorize the master password.
Why does the entropy change when I exclude characters?
Excluding characters shrinks the pool size C in the formula H = L x log2(C), which reduces entropy per character. The tradeoff is readability.
Conclusion
Use this generator whenever you need a password that is actually random. Pair it with a password manager so you never have to memorize or reuse credentials. For passwords you must memorize, try the Passphrase Generator instead, which produces longer but more memorable strings.