How is strength estimated? Why does it say "X days" or "X years to crack"?

Strength is calculated from password entropy: entropy = length × log₂(charset_size). For example, a 20-character password from all printable ASCII (95 chars) gives 20 × log₂(95) ≈ 131 bits. The crack time assumes a fast offline attack at 100 billion guesses per second (10¹¹/s, consistent with a GPU cluster attacking bcrypt-equivalent hashes). crack_time = 2^entropy / 10^11 seconds. Thresholds: < 28 bits = Very Weak, 28–35 = Weak, 36–59 = Fair, 60–127 = Strong, ≥ 128 = Excellent. These are conservative — a weaker hash function would make cracking even faster.

Why crypto.getRandomValues instead of Math.random?

Math.random() is a pseudo-random number generator (PRNG) seeded from a small state — on most engines, its internal state is only 64 bits. A determined attacker who observes a few outputs can reconstruct the seed and predict all future outputs, including your "random" password. crypto.getRandomValues() draws from the operating system's CSPRNG (Cryptographically Secure PRNG), which is seeded from hardware entropy sources (timing jitter, CPU instructions like RDRAND) and passes cryptographic randomness tests. It is the same source used to generate TLS session keys. Always use it for anything security-related.

Are passphrases stronger than random passwords?

It depends on length. A random 4-word passphrase drawn from a 2048-word vocabulary has entropy of 4 × log₂(2048) = 44 bits — roughly equivalent to an 8-character random password from mixed case + digits, which is borderline for 2025 standards. A 6-word passphrase from this tool's ~200-word vocabulary gives 6 × log₂(200) ≈ 45 bits — similar. The real advantage of passphrases is memorability: humans can remember "correct-horse-battery-staple" far more reliably than "kR7!mQ9@". For maximum security, use a long random password (20+ chars, full charset). For something you must remember, use 6+ words with a symbol/number added.

Password Generator

Generate strong, cryptographically random passwords and passphrases — entirely in your browser.

Runs locally
Category Generator
Best for Starting from a blank page without committing to the first result.

Generated

Click Generate

Recent (session)

No history yet — generate a password.

What this tool does

A professional-grade password generator powered by the Web Crypto API (crypto.getRandomValues), not Math.random. Configure length from 6 to 128 characters, choose character sets (uppercase, lowercase, digits, symbols), exclude look-alike characters (0, O, I, l, 1) to avoid transcription errors, or switch to passphrase mode for memorable multi-word passwords. A real-time entropy meter and estimated crack time help you understand exactly how strong your password is. Session history keeps your last 5 generated passwords for comparison. Nothing leaves your browser.

Tool details

Input: Numbers; The page exposes text boxes, numeric controls, file pickers, or structured inputs depending on the tool.
Output: Live result + Copy; The result area focuses on usable output, with copy, download, or preview actions when supported.
Privacy: Browser-side processing; The main tool logic does not call an external API, so inputs normally stay in the current tab.
Save / share: Local preference storage; Preferences, history, or drafts are saved in this browser without an account.
Performance budget: Initial JS <= 15 KB; No WASM budget is declared, keeping the tool quick to open on mobile.
Best fit: Generator · Developer; Category and role tags drive related tools, internal links, and quick fit checks.

How to use

1. Input

Paste or drop your content into the tool panel.
2. Process

Click the button. All processing is local in your browser.
3. Copy / Download

Copy the result or download to disk in one click.

How Password Generator fits into your work

Use it to get a strong first draft, starter asset, or structured output that you can edit before publishing.

Generation jobs

Starting from a blank page without committing to the first result.
Creating repeatable drafts, names, templates, or placeholder assets.
Exploring options before choosing the one that fits the job.

Generation checks

Review generated output before it reaches a customer, page, or document.
Change defaults when you need a specific brand voice, format, or audience.
Keep only the parts that match the real task.

Good next steps

These links move the current task into a more complete workflow.

FAQ

Tool combos

Folks in your role tend to reach for these alongside this tool.

Browse all tools for this role

Password Generator

What this tool does

Tool details

How to use

1. Input

2. Process

3. Copy / Download

How Password Generator fits into your work

Generation jobs

Generation checks

Good next steps

FAQ

Base64 Encoder & Decoder

UUID Generator

Diceware Passphrase Generator

Password Strength Checker

Random Number Generator

QR Code Generator

Password Leak Checker

.htaccess Generator

Markdown TOC Generator

Meta Tag Generator

24-Point Solver & Game

Chinese Acupoint Locator