Random Password Generator

A strong random password has two key properties: length and character pool size. Strength is measured in entropy bits: log₂(pool_size) × length. A 16-character password drawn from 94 printable ASCII characters gives ~104 bits of entropy — effectively uncrackable by brute force.

Visual complexity (mixing cases, symbols) matters less than true randomness. A 20-character lowercase-only password generated by a CSPRNG is stronger than a 10-character 'complex' password picked by a human, because humans are predictable and avoid certain patterns.

Math.random() is a pseudorandom number generator seeded by a predictable value. It is fast and fine for games or simulations, but not suitable for security — its output can be predicted if an attacker knows the seed or observes enough values.

crypto.getRandomValues() (Web Crypto API) is seeded from OS-level entropy sources: hardware interrupts, timing jitter, and other unpredictable events. Its output is computationally infeasible to predict. This tool uses crypto.getRandomValues() exclusively — the same source used by 1Password and Bitwarden.

Recommended minimums depend on the use case:

- Online accounts (email, social): 16 characters minimum. Rate limiting and lockouts make brute force impractical even for shorter passwords, but 16 is future-proof. - Service accounts and API keys: 24–32 characters. - Encryption keys and master passwords: 20+ characters or a 6-word passphrase (~77 bits).

Most password managers default to 16–20 characters. NIST SP 800-63B recommends allowing passwords up to at least 64 characters.

It depends on the use case:

Random character passwords are compact and provide high entropy per character. A 16-character random password (~104 bits) is stronger than most passphrases of equivalent typing effort. Store them in a password manager — you never need to type them.

Passphrases (e.g., correct-horse-battery-staple) are better for passwords you must memorize and type: device logins, full-disk encryption, or a password manager master password. A 5-word Diceware passphrase from the EFF wordlist gives ~64.6 bits and is far more typeable.

Yes — if the generator uses crypto.getRandomValues() and runs entirely client-side. This tool generates passwords directly in your browser without any network requests. You can verify this by opening DevTools → Network tab and watching: no requests are made when generating passwords.

The generated passwords exist only in your browser's memory and are never transmitted anywhere. For maximum security, you can also download this page and run it offline.