Password Generator

Ordinary pseudo-random number generators, the kind used for games or sampling, are not safe for secrets because their output can sometimes be predicted if an attacker learns the internal state or seed. This generator instead uses your browser’s Web Crypto API (crypto.getRandomValues), which draws from an operating-system-level entropy source designed specifically to resist prediction.

This distinction matters: a password generated with a weak RNG can theoretically be reproduced by an attacker who understands the algorithm, while a cryptographically secure RNG is designed so that knowing the algorithm provides no practical advantage in guessing future or past outputs.

Password strength is often measured in bits of entropy, calculated as length × log₂(character set size). A 12-character password using only lowercase letters (26 possibilities per character) has about 12 × log₂(26) ≈ 56 bits of entropy, while the same 12-character length using upper, lower, numbers, and symbols (roughly 94 possibilities) reaches about 12 × log₂(94) ≈ 79 bits.

Each additional character adds far more entropy than expanding the character set does, which is why security guidance increasingly emphasizes length — a 16-character password from a modest character set is typically much stronger than an 8-character password stuffed with every symbol available.

Including symbols and mixed case raises entropy per character, but some older systems restrict which symbols are accepted, and copy-pasting certain symbols can occasionally cause issues in some form fields or PDF viewers. Toggle character sets to match whatever rules the specific website or system requires.

• Lowercase letters (a–z): baseline character set, always safe to include.
• Uppercase letters (A–Z): doubles usable characters when combined with lowercase.
• Numbers (0–9): often required by password policies; adds moderate entropy.
• Symbols (!@#$%...): highest entropy per character, but occasionally restricted by legacy systems.

A strong, unique password for every account is only half the picture. Store generated passwords in a reputable password manager rather than memorizing or reusing them, enable multi-factor authentication wherever it is offered (especially for email and banking, since these are common recovery-flow targets for attackers), and avoid leaving a freshly generated password sitting in your clipboard on a shared or public computer.

Machine-to-machine secrets, such as API keys, should generally come from your cloud provider’s dedicated secret manager with built-in rotation policies rather than a browser-based generator like this one, which is designed for human-facing account passwords.

A passphrase — several random words strung together, such as "coral-ledger-piano-velvet" — can be both long and memorable while still resisting brute-force guessing, provided the words are chosen randomly rather than from a famous quote or song lyric attackers already catalog.

This generator produces character-level randomness, which maximizes entropy per character for sites with strict symbol requirements. When a site allows long passwords without demanding symbols, a random passphrase of four or five unrelated words is often easier to type on a phone keyboard while still meeting length-based strength rules.

Reusing one strong password across multiple sites defeats the purpose of generating it. Credential-stuffing attacks try leaked email-and-password pairs from one breach against other services automatically. A password manager makes unique passwords practical because you only memorize one master secret.

For casual games, raffles, or classroom sampling where cryptographic strength is not required, the Random Number Generator is the lighter tool — keep this page for account secrets and anything that must stay unpredictable.