Password Generator
Generate strong, random passwords instantly — free, no account required.
What Makes a Strong Password?
A strong password is long, random, and used exactly once — for one account, never reused. The National Institute of Standards and Technology (NIST) revised its password guidance in SP 800-63B to reflect what security research has confirmed for years: length beats complexity. A 20-character lowercase passphrase is stronger than an 8-character mix of symbols, numbers, and case — because length exponentially expands the number of possible combinations an attacker must try.
The 2022 LastPass breach exposed encrypted password vaults for millions of users. The 2021 RockYou2021 compilation contained 8.4 billion plaintext passwords — the largest credential list ever assembled. Credential stuffing, where attackers test leaked username-password pairs against hundreds of services simultaneously, is now fully automated and runs at industrial scale. The only reliable defence is a unique, high-entropy password for every account.
This generator uses crypto.getRandomValues() — the browser's cryptographically secure random number generator — to assemble your password. Nothing leaves your device.
How the Password Generator Works
Select your character types, set your length, and click Generate. The tool assembles a character pool from your chosen sets, then draws each character position independently using crypto.getRandomValues() with rejection sampling to eliminate modulo bias. The result is a password with full, unbiased entropy across the entire pool.
Completely client-side. Open your browser's DevTools Network tab and watch while you generate passwords — you will see zero outbound requests. No password data touches our servers at any point. This is not a policy claim; it is an architectural fact you can verify yourself.
Bulk generation supports up to 50 passwords per click, useful for IT provisioning, developer workflows, or auditing your existing accounts. Copy All sends them to your clipboard as a newline-separated list ready to paste into a spreadsheet or password manager import file.
Entropy: The Honest Measure of Password Strength
Most tools show you a coloured bar. We show you bits of entropy — because a bar without a number tells you nothing actionable. Entropy is calculated as log₂(pool size) × length. With all character types enabled and a length of 16, your pool is 95 printable ASCII characters and your entropy is approximately 105 bits.
To contextualise: a modern GPU cluster can attempt roughly 100 billion MD5 hashes per second. At that rate, exhausting a 72-bit keyspace takes over 1,000 years on average. At 105 bits, the expected crack time exceeds the age of the observable universe. NIST SP 800-63B recommends evaluating passwords against known breach lists and checking entropy rather than enforcing arbitrary composition rules — our meter is built around that philosophy.
Password Best Practices for US Users
- One password per account, no exceptions. The 2022 Uber breach began with a contractor's password reused from a personal account that had appeared in a prior leak. Reuse turns every breach into a master key.
- Enable multi-factor authentication (MFA). The Cybersecurity and Infrastructure Security Agency (CISA) consistently lists MFA as the single highest-impact action individuals and organisations can take. Even a compromised password cannot unlock an account protected by a hardware key or authenticator app.
- Use a password manager. NIST explicitly endorses password managers. Apps like Bitwarden (open-source), 1Password, and others allow you to maintain hundreds of unique passwords without memorising any of them.
- Check for breaches. The FTC and CISA both recommend monitoring for credential exposure. HaveIBeenPwned.com is free and checks your email against billions of leaked records.
- Be sceptical of security questions. "Mother's maiden name" and "first pet" answers are often guessable or findable on social media. Treat security question answers as secondary passwords — generate a random string and store it in your password manager.
Password Security in the United States: Regulatory and Threat Context
US password requirements are governed by a patchwork of sector-specific regulations: HIPAA for healthcare, PCI DSS for payment card data, SOX for public company financial systems, and state-level privacy laws including CCPA (California), VCDPA (Virginia), and others. NIST SP 800-63B provides the federal baseline that most agencies and many private-sector organisations follow.
The US experiences the highest volume of credential-based breaches globally. Notable recent incidents include the 2022 LastPass vault breach, the 2021 Colonial Pipeline ransomware attack (initiated via a legacy VPN account with no MFA), and the 2024 National Public Data breach exposing nearly 3 billion records including Social Security numbers. Each began with a compromised credential.
FAQ
- What password length does NIST recommend?
- NIST SP 800-63B recommends allowing passwords of up to 64 characters and no longer mandating arbitrary complexity rules. Their guidance focuses on length and checking against known breach lists. For practical security, 16 characters with mixed character types provides ~105 bits of entropy — far beyond what any foreseeable brute-force attack can reach.
- Is this generator truly random?
- Yes. It uses
crypto.getRandomValues(), the browser's cryptographically secure pseudorandom number generator (CSPRNG). This is the same API used by cryptographic libraries and TLS implementations. It is fundamentally different fromMath.random(), which is not cryptographically secure and should never be used for security-sensitive purposes. - Should I use a passphrase instead of a random password?
- Both are valid. NIST notes that long passphrases ("correct horse battery staple") are easier to remember and can achieve high entropy. Our pronounceable mode offers a middle ground — memorable phonetic patterns with injected numbers and symbols. For a password manager, a fully random 20+ character password is ideal since you never need to type it from memory.
- Can the website owner see my generated password?
- No. Generation happens entirely in your browser. Our server delivers the page once, then plays no further role. There is no WebSocket connection, no POST request on generate, no telemetry payload containing your password. You can verify this in your browser's Network tab.
- What is credential stuffing and how does a strong password protect me?
- Credential stuffing is an automated attack where stolen username-password pairs from one breach are tested against other services. Because most people reuse passwords, attackers achieve a meaningful hit rate even with old leaked lists. A unique password per service eliminates this attack entirely — a stolen credential from one service is useless against any other.
- How many passwords can I generate at once?
- Up to 50. Use the number control to set your count, then click Generate. The "Copy All" button copies all passwords to your clipboard as a newline-separated list, ready to paste into a password manager bulk-import file or a spreadsheet for IT provisioning.