Strong Password Generator

Password strength is a math problem, not a cleverness problem. What matters is entropy — the number of possible combinations an attacker must try — and entropy comes from two things: length and alphabet size. A 10-character password using all four character types (~65 bits) falls to a modern GPU rig in days; the same alphabet at 16 characters (~104 bits) would take longer than the age of the universe. That is why the strength meter on this page reports entropy in bits rather than vague color bars: length beats trickery, every time.

Where a password is generated matters almost as much as how strong it is. This tool uses your browser's window.crypto.getRandomValues() — the same cryptographic randomness source that secures HTTPS connections — and everything happens offline on your device. The password never touches a network request, a server log, an analytics event, or a database. A password that has existed only in your browser's memory and your clipboard has a far smaller attack surface than one produced by a server-side generator you have to trust.

The workflow that makes all of this practical is pairing this generator with a password manager. Generate a unique 16–20 character password here for each account, store it in your manager, and let autofill do the remembering. Unique passwords per site mean a breach at one service leaks nothing about your other accounts — which is the single biggest security upgrade most people can make.