Runs entirely in your browser — nothing leaves this page.
Password generator
crypto.getRandomValues, length and charset options, entropy estimate.
20
≈ 129 bits of entropy
How these passwords are generated
Characters are drawn from crypto.getRandomValues, the browser's cryptographic random source, not from Math.random. The entropy estimate shown is the real one for the alphabet and length you selected: log2(alphabet size) multiplied by length.
Nothing is generated on a server and nothing is stored, so the password exists only in this tab until you copy it.
How many bits of entropy do I actually need?
For a password behind rate limiting, 60 bits is comfortable. For something that could be attacked offline — a disk key, a password manager master password, a long-lived service credential — target 100 bits or more. The number updates as you change length and character sets.
Should I use symbols?
They add about 6 bits over alphanumeric at the same length, which four extra characters also buy you. If a system mangles symbols — and plenty still do — length is the more reliable lever.
Is a generated password better than a passphrase?
Only if you never have to type it. For anything you memorise, a passphrase of five random words reaches similar entropy and survives being typed on a phone. For credentials that live in a password manager or a Secret, random characters are strictly better.
Related tools: bcrypt / htpasswd, Password leak check and UUID / ULID generator.