Password Generator & Strength Checker
Generate 8–128 character passwords with cryptographic randomness, current-guidance presets, pattern-aware strength estimates, and an optional breached-password lookup.
⚙Generate Password
Presets
Upper-bound search space for these settings: about 119 bits
🔍Check Strength
Paste or type a password…
How to use the Password Generator
- 1
Click Compatible, Standard, or Strong to generate a 16-, 20-, or 32-character password.
- 2
Use the length slider (8–128 characters), toggle character classes, and optionally remove ambiguous characters.
- 3
Click 'Copy' to copy the password to your clipboard, or 'Regenerate' to get a new one with the same settings.
- 4
Use Check Strength for a local estimate and optionally run a k-anonymity lookup against known breached passwords.
Features
- ✓Cryptographically secure: Uses crypto.getRandomValues() from the Web Cryptography API — not the predictable Math.random().
- ✓Rejection-sampled random indexes and a Fisher-Yates shuffle avoid modulo bias while guaranteeing at least one character from every enabled class.
- ✓5-level strength gauge combines a search-space estimate with penalties for weak words, repetition, and keyboard or numeric sequences.
- ✓Generation and estimation run locally. Breach lookup sends a five-character hash prefix only after you explicitly request it.
FAQ
Q. What makes this generator more secure than others?
A. This tool uses crypto.getRandomValues(), a cryptographically strong random number generator built into browsers. Unlike Math.random(), it produces unpredictable values — a critical requirement for password security.
Q. What makes a strong password?
A. A practical default is a unique password of at least 16 characters stored in a password manager. Standard uses 20 characters and Strong uses 32.
Q. Are generated passwords saved anywhere?
A. No. All processing happens completely in your browser. Generated passwords are never transmitted to or stored on any server.
Q. Can I use generated passwords with a password manager?
A. Yes. Click 'Copy' to copy the password to your clipboard and paste it directly into 1Password, Bitwarden, LastPass, or any password manager. It also works seamlessly with browser autofill.
Q. What should I do if a site doesn't allow symbols?
A. Simply uncheck the 'Symbols' option and regenerate. A combination of uppercase, lowercase, and numbers at 16+ characters still provides strong security without any symbols.
Technical Deep Dive: Cryptographic Randomness & Password Generation
Math.random() — the browser's built-in pseudo-random number generator (PRNG) — is based on algorithms like xorshift128+ or linear congruential generation. Because it is deterministic, knowledge of the internal seed allows full prediction of future outputs, making it wholly unsuitable for security-sensitive use. This tool uses crypto.getRandomValues() from the W3C Web Cryptography API, which calls the operating system's cryptographically secure PRNG (CSPRNG): getrandom() or /dev/urandom on Linux, BCryptGenRandom on Windows, and SecRandomCopyBytes on macOS/iOS. These sources derive entropy from physical events such as hardware interrupts, thermal noise, and timing jitter.
Taking a random 32-bit integer modulo the pool length can introduce bias. This generator rejects values outside the largest evenly divisible range, selects one character from every enabled class, fills the remainder from the combined pool, and then applies a Fisher-Yates shuffle.
The generator displays H = L × log₂(N), where L is length and N is the selected character pool, as an upper-bound search-space estimate. Because each enabled character class is guaranteed, this is not a claim of exact Shannon entropy.
The strength checker estimates search space from length and character classes, then penalizes known weak words, repeated characters, and sequences such as abcd, 1234, or qwerty. The optional Pwned Passwords lookup only checks known exposure and a non-match cannot prove that a password is safe.
Data Handling & Privacy
Generated passwords exist only in browser memory. The string produced by crypto.getRandomValues() is written to the clipboard via navigator.clipboard.writeText() when you click 'Copy' — no network communication occurs at any step.
Passwords entered into the strength checker are evaluated by a local heuristic and never sent to this service. The estimate is intentionally described as guidance rather than a guarantee or a breached-password lookup.
Generation and the local strength estimate run client-side. If you request a breached-password check, only the first five characters of a SHA-1 hash are sent to Have I Been Pwned's Pwned Passwords API, and the returned candidates are compared in the browser. The password and full hash are not transmitted. On shared devices, also consider clipboard history, browser extensions, and other device-side exposure.
Examples, Safe Operation, and Common Mistakes
Examples
- Generate a unique long password when creating a new account.
- Replace reused legacy passwords with strong values stored in a password manager.
- Create separate passwords per personal or business account instead of sharing one value.
Cautions
- Store generated passwords in a trusted password manager.
- Enable two-factor authentication for important accounts in addition to using strong passwords.
- Do not paste generated passwords into shared chats, emails, or public documents.
Common Mistakes
- Making passwords too short just to keep them memorable.
- Reusing the same password across multiple services.
- Keeping a leaked password by changing only one or two characters.