password Password Generator star

How It Works

Password strength is not additive, it is exponential: the number of possible combinations equals the character-set size raised to the power of the length (charset^length), and that exponent is what makes length the single biggest lever available. An 8-character password using only lowercase letters draws from a 26-character set, giving 26^8 — roughly 208 billion possible combinations, which sounds like a lot until modern hardware tests billions of guesses per second. Add uppercase, digits and symbols and extend the length to 12 characters, and the set grows to roughly 95 characters, giving 95^12 — on the order of 540 sextillion (5.4 × 10^23) combinations. That is not a modest improvement; it is many orders of magnitude larger, because every extra character multiplies rather than adds to the total. Concrete example: going from an 8-character lowercase-only password to a 12-character password with all four character types does not just double security, it moves the brute-force time from "crackable in a reasonable stretch" to "far beyond any realistic attack, even against future hardware."

This generator draws every character using crypto.getRandomValues — the browser's cryptographically secure random number generator — rather than Math.random(). That distinction matters: Math.random() is a fast, predictable pseudo-random generator meant for animations and games, and its internal state can in some cases be reconstructed from observed output, making it unsuitable for anything security-related. crypto.getRandomValues pulls from the operating system's cryptographic entropy source, which is specifically designed to be unpredictable even to an attacker who has seen previous outputs.

What to Know

Length beats complexity almost every time. A 16-character password using only lowercase letters (26^16) is mathematically far stronger than an 8-character password mixing every character type (95^8), simply because the exponent dominates the base. When choosing between a longer, simpler password and a shorter, more complex one, choose longer.

The password never leaves your device: it is generated entirely in your browser and nothing is transmitted to any server, logged or stored anywhere by this tool. Refreshing or closing the page destroys it completely, which is exactly why it should be copied straight into a password manager rather than left on screen or in a text file.

Reusing one password across multiple accounts turns a single data breach into many. If one site's database leaks — and breaches happen even to careful, well-run services — every other account sharing that password becomes vulnerable the moment the breached password list starts circulating. A unique, generated password per site, stored in a password manager, contains the damage from any single breach to that one account.