Password Generator

Entropy is the only honest metric. A password's resistance to attack is measured in bits of entropy: entropy = length × log₂(pool size). Each bit doubles the number of possible combinations. A 16-character password drawn from 94 printable symbols holds roughly 105 bits — 2¹⁰⁵ candidates. Against an attacker guessing 10 billion combinations per second, that is ~1.3 × 10²² years. The same length in lowercase-only letters is only 75 bits — 30,000× weaker, though still billions of years.

Why human-made passwords always lose. People anchor on memory, not randomness. Real-world passwords cluster around a few thousand patterns: dictionary words, names, keyboard runs (qwerty), dates, and leetspeak flips (P@ssw0rd!). Attackers don't brute-force — they feed these wordlists plus mangling rules to offline crackers. PasswordMeter-style tools that score human passwords are checking against known-pattern lists; a random generator sidesteps the entire class of attack by having no pattern at all.

Length beats complexity. Mandating "one uppercase, one number, one symbol" forces humans into predictable substitutions. The US NIST 800-63B guideline (rev 3) explicitly drops complexity rules in favor of length: a 15-character random password beats a "compliant" 8-character one with special chars every time, and users can actually type it. When you must memorize, generate a passphrase instead — 5-7 random words from a 7,776-word EFF list carry 65-90 bits of entropy and are memorable enough to use as a master password.

API keys need more than length. A production API key should embed ≥128 bits of random entropy (32-byte base64url ≈ 43 chars) and carry a scannable prefix so you can identify the environment and service at a glance. Never put keys in URLs, client-side bundles, or logs. Rotate on schedule and on any suspected exposure. If a key only has 64 bits of entropy (e.g., a short hex string), a determined attacker with a GPU farm can crack it in weeks — treat short keys as immediately compromised.

The password manager argument. Humans can't hold 200 unique strong passwords. A password manager (Bitwarden, 1Password, KeePassXC) stores each site's unique random password behind one strong master passphrase. This tool's batch mode is built for exactly that workflow: generate 5 candidates, pick one, paste it into your manager. The only password you ever need to remember is the master passphrase.

Why this generator is trustworthy. Entropy comes from crypto.getRandomValues() — the Web Crypto API backed by the OS-level CSPRNG (CryptGenRandom on Windows, getrandom on Linux, SecureRandom on macOS). It is not Math.random(), which is a seeded PRNG and must never be used for security. The page makes zero network requests: generate with Wi-Fi off to verify, or inspect the Network tab — nothing to see.

See also: Password Crack Time Estimator · Hash Generator · JWT Decoder · Base64 Encode/Decode