What Makes a Password Secure? (Entropy, Not Just Length)
A strong password generator needs to solve a problem most hand-rolled code gets quietly wrong, and this random password generator online does it correctly: every password is produced with a cryptographically secure random number generator, not a general-purpose one. Use it to generate random password values on demand, or think of this section as password entropy explained from first principles: strength isn't really about length or "having a symbol", it comes down to entropy, how many possible passwords the generation process could have produced, expressed in bits. The formula is length times log2 of the character set size. A 12-character password using only lowercase letters (26 possible characters) has about 56 bits of entropy; the same 12 characters drawn from lowercase, uppercase, digits, and symbols (roughly 94 possible characters) has about 79 bits, a meaningfully larger keyspace from the same visible length, because each character carries more information.
Why Math.random() Is Not Safe for Passwords
Is math.random safe for passwords? No. JavaScript's Math.random() is a fast, general-purpose pseudorandom number generator, not a cryptographically secure one; its internal state can, in principle, be reconstructed from enough output, which makes it unsuitable for anything security-sensitive. As a genuinely secure password generator, this tool uses crypto.getRandomValues() instead, part of the Web Crypto API, backed by the operating system's actual cryptographic random source, the same class of randomness used for encryption keys.
How Long Would It Take to Crack This Password?
How long to crack a password depends almost entirely on its entropy. This tool shows an estimated crack time alongside the entropy bits, assuming a fixed offline guessing rate, so the abstract bit count translates into something concrete: a password with 40 bits of entropy might fall in hours, while one with 80 or more bits would take longer than is practically feasible with current computing resources. The estimate is a useful reference point, not a guarantee, since real-world attacks (phishing, credential reuse, a breach of the service storing the password) don't care how strong the password itself was.
| Entropy (bits) | Strength band | Rough crack-time order of magnitude |
|---|---|---|
| < 28 | Very weak | Instant to seconds |
| 28 to 39 | Weak | Minutes to hours |
| 40 to 59 | Fair | Days to years |
| 60 to 79 | Strong | Centuries |
| 80+ | Very strong | Longer than is practically feasible |
Passphrases: A Different Security Model
Rather than random characters, passphrase mode strings together several random dictionary words. A four-word passphrase can carry as much or more entropy as a shorter random-character password while being genuinely easier for a human to remember and type, the same principle behind Diceware-style passphrase generation. PIN mode, the third option, generates a purely numeric sequence for systems that specifically require one, with correspondingly less entropy per digit than a full character set would provide at the same length. Adding symbols to a password increases its charset size and therefore its entropy per character, but a service that rejects certain symbols, or a person who has to type the password on a phone keyboard, changes the practical tradeoff, so this tool also works as a random password generator no symbols, simply disable the symbols toggle to fit that constraint.
What This Tool Does Not Do
This tool generates strong passwords, it doesn't manage or store them, use a dedicated password manager for that. Entropy measures resistance to brute-force guessing specifically; it says nothing about phishing resistance, credential reuse across services, or the security of wherever the password ends up stored. Nothing generated here is transmitted, logged, or stored anywhere; every password is produced entirely client-side using the Web Crypto API.