Password Generator

Q: Is it safe to generate passwords in a web browser?

Yes. This generator runs entirely client-side using the browser's Web Crypto API (crypto.getRandomValues), so passwords are never transmitted, stored, or logged. Nothing leaves your device.

Q: What is password entropy and how many bits do I need?

Entropy measures unpredictability in bits — each bit doubles the number of guesses needed to crack the password. Aim for at least 80 bits for important accounts, and 100+ bits for high-value secrets.

Q: Are passphrases more secure than random passwords?

A passphrase can match or beat a random password if it has enough words. Each random word from a large list adds roughly 12-13 bits of entropy, so a 5-6 word Diceware-style passphrase is both strong and easier to remember.

Q: Why should I exclude ambiguous characters like 0, O, l, 1 and I?

Excluding visually similar characters prevents transcription errors when reading or typing a password manually. It slightly shrinks the character pool, so add a little length to keep the same entropy.

Q: Does crack time alone tell me if my password is strong?

Not by itself. The crack-time estimate assumes brute force at 1 trillion guesses per second, but real attacks exploit reuse, leaks, and dictionary patterns. Use a unique, high-entropy password per account and a password manager.

Password Generator

Generating...

... 0 bits

Calculating...

About This Tool

Generate strong, random passwords using the browser’s cryptographic random number generator (crypto.getRandomValues). Choose between character-based passwords and Diceware-style passphrases for maximum security. Rejection sampling eliminates modular bias for uniform randomness.

Features

Crypto-secure randomness — uses Web Crypto API with rejection sampling
Password & passphrase modes — character-based or word-based
Entropy estimation — bits of entropy calculated in real-time
Crack time estimate — how long to brute-force at 1 trillion guesses/sec
Exclude ambiguous characters — remove 0, O, l, 1, I to avoid confusion
Customizable — length, character sets, word separators, capitalize, add number

How do I use it?

Choose between Password or Passphrase mode
Adjust length and character sets (or word count/separator)
Optionally exclude ambiguous characters
Click Generate or copy directly to clipboard

Is it private?

All password generation happens entirely in your browser using the Web Crypto API. No passwords are transmitted, stored, or logged. Your generated passwords never leave your device.

Linux Command Reference

You can generate passwords from the terminal using built-in Linux tools. Here are the most common methods:

Random Password (mixed charset)

tr -dc ‘A-Za-z0-9!@#$%^&*’ < /dev/urandom | head -c 20; echo

2!P1n4guiZoDakfl^$kb

Alphanumeric Only

tr -dc ‘A-Za-z0-9’ < /dev/urandom | head -c 20; echo

A0efMcTih9nrMk00jwcC

Using OpenSSL

# Base64 encoded (32 chars)

openssl rand -base64 24

# Hexadecimal (32 chars)

openssl rand -hex 16

1M6FfJr6NlDSLw9gv778Vij+TQ71K4Wq190c2dfbaa87d6913dceb851da074529

Batch Generation

for i in $(seq 1 5); do

tr -dc 'A-Za-z0-9!@#$%^&*' < /dev/urandom | head -c 16

echo

done

KOPzWKzFRxELibkqlg5ZcvgkwkjP5NRVqbKCBZjFF3KpiiQNMn4k6G9OCpJAPfwpR900Qx98a5lsM9KoN

Passphrase (Diceware-style)

# Pick 5 random words from system dictionary

grep -E '^[a-z]{4,8}$' /usr/share/dict/words | shuf -n 5 | paste -sd '-'

coiling-hurdled-splodge-whatever-evoking

Using pwgen

pwgen is a dedicated password generator available in most distributions (sudo apt install pwgen). It supports pronounceable and fully random modes.

# Secure random, 20 chars

pwgen -s 20 1

# With symbols

pwgen -sy 20 1

# No ambiguous chars (0O l1I)

pwgen -sB 20 1

# Pronounceable (easier to remember)

pwgen 16 1

SHbLIPZyUV14zD8A3oy5^JVR/.gSlO7Oqx;I%lCxipWxHLHUUnfYohXxj4PVjeigiejeif4dooKa

# Batch: 5 secure passwords with symbols

pwgen -sy1 16 5

8sQjvZe|wCt5x#10ZVFFnjMxP]4]oAvc[-c9c7jutE~DMC9xgVO3RMb=qbw7dKC4ym_QneYiM|jrVW

Entropy Calculation

python3 -c "

import math

pool = 26+26+10+8 # A-Z, a-z, 0-9, symbols

length = 20

entropy = math.log2(pool) * length

years = (2**entropy / 1e12) / 31557600

print(f'Pool: {pool} chars')

print(f'Entropy: {entropy:.1f} bits')

print(f'Crack time (1T/s): {years:.2e} years')

Pool: 70 charsEntropy: 122.6 bitsCrack time (1T/s): 2.53e+17 years

Frequently asked questions

Is it safe to generate passwords in a web browser?

Yes. This generator runs entirely client-side using the browser's Web Crypto API (crypto.getRandomValues), so passwords are never transmitted, stored, or logged. Nothing leaves your device.

What is password entropy and how many bits do I need?

Entropy measures unpredictability in bits — each bit doubles the number of guesses needed to crack the password. Aim for at least 80 bits for important accounts, and 100+ bits for high-value secrets.

Are passphrases more secure than random passwords?

A passphrase can match or beat a random password if it has enough words. Each random word from a large list adds roughly 12-13 bits of entropy, so a 5-6 word Diceware-style passphrase is both strong and easier to remember.

Why should I exclude ambiguous characters like 0, O, l, 1 and I?

Excluding visually similar characters prevents transcription errors when reading or typing a password manually. It slightly shrinks the character pool, so add a little length to keep the same entropy.

Does crack time alone tell me if my password is strong?

Not by itself. The crack-time estimate assumes brute force at 1 trillion guesses per second, but real attacks exploit reuse, leaks, and dictionary patterns. Use a unique, high-entropy password per account and a password manager.