✦ tomai
Free · Everyday Tools

Password Generator

Cryptographically secure passwords with entropy & crack-time estimates

What Is a Password Generator?

A strong password is random — and randomness is exactly what humans are bad at: people invent predictable passwords and reuse them across sites. This generator creates cryptographically secure random passwords using the Web Crypto API, with length from 4 to 128 characters and selectable character sets: uppercase, lowercase, digits, and symbols. You can exclude ambiguous characters such as 0, O, 1, l, I, and | so passwords stay readable, and each click returns five candidates at once. Every password comes with its entropy in bits, a strength grade, and an estimated crack time based on a 10-billion-guesses-per-second offline attack — an honest way to see what a password is actually worth. Everything runs locally, so generated passwords never travel over the network.

What this tool can do

  • 🔢 Length slider from 4 to 128 characters
  • 🔠 Character sets: uppercase, lowercase, digits, symbols
  • 🚫 Exclude ambiguous characters like 0, O, 1, l, I, and |
  • 🎰 Bias-free random generation via Web Crypto
  • 📊 Entropy in bits with a strength grade
  • ⏱️ Estimated crack time for each password
  • 🗂️ Five passwords per generation, each with its own copy button

When you will use it

  • Creating a password for a new account
  • Replacing a password you have reused across many sites
  • Generating an application secret or API key
  • Setting a Wi-Fi or device password

Privacy: passwords are generated locally with Web Crypto — never transmitted, never logged. Store them in a password manager afterwards.

Last updated · 2026-09-01

Generate a strong password in four steps

  1. 1

    Drag the length slider — 16 characters or more is a sensible default for anything new.

  2. 2

    Tick the character sets the target site allows; if you will type the password by hand, exclude look-alike characters like 0/O and 1/l/I.

  3. 3

    Press Generate: five fresh candidates appear instantly, each labelled with its entropy in bits and an estimated crack time.

  4. 4

    Copy the one you like into your password manager — the crack-time figure tells you exactly what you are getting.

Why this generator is safe to trust

Every random number comes from your operating system’s cryptographic RNG — the same source your browser uses for TLS session keys.

🎰

Bias-free randomness

Lengths run from 4 to 128 characters across four character sets, sampled with rejection so no character class wins by modulo bias — the classic trap of simple random generators.

📊

Entropy and crack time

Every candidate shows entropy in bits, a strength grade with a colored meter, and an estimated offline crack time at 10 billion guesses per second, so the trade-offs are on the page, not in your head.

🗂️

Five candidates, readable characters

Each generation returns five distinct passwords with a copy button on every row, and the ambiguous-character toggle removes look-alikes like 0, O, 1, l, I, and the pipe.

✈️

No account, no network

Generation runs entirely on your device — unplug the network and it works exactly the same.

How the entropy maths works

A password’s strength is its information entropy: length × log₂(alphabet size). With all four character sets enabled the alphabet has about 94 symbols, so:

  • 12 characters ≈ 78 bits
  • 16 characters ≈ 104 bits
  • 20 characters ≈ 131 bits

Every extra bit doubles an attacker’s work — which is why sliding length up beats sprinkling in extra symbols.

Frequently asked questions

How random are these passwords?⌄

They use your browser’s Web Crypto API (crypto.getRandomValues) — the same cryptographically secure randomness used for encryption keys — with rejection sampling to avoid modulo bias. Nothing is generated on, or sent to, any server.

How long should my password be?⌄

Aim for at least 60 bits of entropy for normal accounts and 80+ bits for email, banking and password-manager master passwords. With all character sets enabled, 12 characters ≈ 78 bits and 16 characters ≈ 104 bits.

What does the crack-time estimate assume?⌄

A strong offline attack at 10 billion guesses per second against the full random character space. Real online attacks are millions of times slower, so the estimate is deliberately conservative.

Is a passphrase better than a random password?⌄

If you have to memorise it, yes: four or five unrelated words give similar entropy and are far easier to remember. For logins stored in a password manager, a fully random string wins on typing safety across devices. Either way, aim for at least 80 bits.

Related tools

Related tools