# Password Generator

> One page from jmrp.io, published as markdown. Index: https://jmrp.io/llms.txt

Canonical: https://jmrp.io/tools/password-generator/
Language: en
Alternate: https://jmrp.io/es/tools/password-generator/index.md
Updated: 2026-09-03
License: https://jmrp.io/license/
Category: security
Tags: password, security, crypto, passphrase, entropy

Generate strong passwords and passphrases using the Web Crypto API. Estimate entropy, crack time, and customize character sets — all client-side.
Build-Date: 2026-09-06

Features:
- Web Crypto API with rejection sampling
- Password and Diceware passphrase modes
- Real-time entropy and crack-time estimates
- Customizable length, charsets, and separators
- Excludes ambiguous characters, runs client-side

Questions answered:

**Is it safe to generate passwords in a web browser?**

Yes. This generator runs entirely client-side using the browser's Web Crypto API (crypto.getRandomValues), so passwords are never transmitted, stored, or logged. Nothing leaves your device.

**What is password entropy and how many bits do I need?**

Entropy measures unpredictability in bits — each bit doubles the number of guesses needed to crack the password. Aim for at least 80 bits for important accounts, and 100+ bits for high-value secrets.

**Are passphrases more secure than random passwords?**

A passphrase can match or beat a random password if it has enough words. Each random word from a large list adds roughly 12-13 bits of entropy, so a 5-6 word Diceware-style passphrase is both strong and easier to remember.

**Why should I exclude ambiguous characters like 0, O, l, 1 and I?**

Excluding visually similar characters prevents transcription errors when reading or typing a password manually. It slightly shrinks the character pool, so add a little length to keep the same entropy.

**Does crack time alone tell me if my password is strong?**

Not by itself. The crack-time estimate assumes brute force at 1 trillion guesses per second, but real attacks exploit reuse, leaks, and dictionary patterns. Use a unique, high-entropy password per account and a password manager.


---

**Interactive tool** — this page hosts the working application itself, not a description of one.

## About This Tool

Generate strong, random passwords using the browser's cryptographic random number generator (`crypto.getRandomValues`). Choose between character-based passwords and Diceware-style passphrases for maximum security. Rejection sampling eliminates modular bias for uniform randomness.

### Features

- **Crypto-secure randomness** — uses Web Crypto API with rejection sampling
- **Password & passphrase modes** — character-based or word-based
- **Entropy estimation** — bits of entropy calculated in real-time
- **Crack time estimate** — how long to brute-force at 1 trillion guesses/sec
- **Exclude ambiguous characters** — remove 0, O, l, 1, I to avoid confusion
- **Customizable** — length, character sets, word separators, capitalize, add number

### How do I use it?

1. Choose between Password or Passphrase mode
2. Adjust length and character sets (or word count/separator)
3. Optionally exclude ambiguous characters
4. Click Generate or copy directly to clipboard

### Is it private?

All password generation happens entirely in your browser using the Web Crypto
API. No passwords are transmitted, stored, or logged. Your generated passwords
never leave your device.

### Linux Command Reference

You can generate passwords from the terminal using built-in Linux tools. Here
are the most common methods:

#### Random Password (mixed charset)

```bash
tr -dc 'A-Za-z0-9!@#$%^&*' < /dev/urandom | head -c 20; echo
```

**Output — Generated Password**

```text
2!P1n4guiZoDakfl^$kb
```

#### Alphanumeric Only

```bash
tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 20; echo
```

**Output — Alphanumeric Password**

```text
A0efMcTih9nrMk00jwcC
```

#### Using OpenSSL

```bash
# Base64 encoded (32 chars)
openssl rand -base64 24

# Hexadecimal (32 chars)
openssl rand -hex 16
```

**Output — OpenSSL Passwords**

```text
1M6FfJr6NlDSLw9gv778Vij+TQ71K4Wq
190c2dfbaa87d6913dceb851da074529
```

#### Batch Generation

```bash
for i in $(seq 1 5); do
  tr -dc 'A-Za-z0-9!@#$%^&*' < /dev/urandom | head -c 16
  echo
done
```

**Output — Batch Passwords**

```text
KOPzWKzFRxELibkql
g5ZcvgkwkjP5NRVq
bKCBZjFF3KpiiQNM
n4k6G9OCpJAPfwpR
900Qx98a5lsM9KoN
```

#### Passphrase (Diceware-style)

```bash
# Pick 5 random words from system dictionary
grep -E '^[a-z]{4,8}$' /usr/share/dict/words | shuf -n 5 | paste -sd '-'
```

**Output — Generated Passphrase**

```text
coiling-hurdled-splodge-whatever-evoking
```

#### Using pwgen

`pwgen` is a dedicated password generator available in most distributions (`sudo apt install pwgen`). It supports pronounceable and fully random modes.

```bash
# Secure random, 20 chars
pwgen -s 20 1

# With symbols
pwgen -sy 20 1

# No ambiguous chars (0O l1I)
pwgen -sB 20 1

# Pronounceable (easier to remember)
pwgen 16 1
```

**Output — pwgen Passwords**

```text
SHbLIPZyUV14zD8A3oy5
^JVR/.gSlO7Oqx;I%lCx
ipWxHLHUUnfYohXxj4PV
jeigiejeif4dooKa
```

```bash
# Batch: 5 secure passwords with symbols
pwgen -sy1 16 5
```

**Output — pwgen Batch Passwords**

```text
8sQjvZe|wCt5x#10
ZVFFnjMxP]4]oAv
c[-c9c7jutE~DMC9
xgVO3RMb=qbw7dK
C4ym_QneYiM|jrVW
```

#### Entropy Calculation

```bash
python3 -c "
import math
pool = 26+26+10+8  # A-Z, a-z, 0-9, symbols
length = 20
entropy = math.log2(pool) * length
years = (2**entropy / 1e12) / 31557600
print(f'Pool: {pool} chars')
print(f'Entropy: {entropy:.1f} bits')
print(f'Crack time (1T/s): {years:.2e} years')
"
```

**Output — Entropy Analysis**

```text
Pool: 70 chars
Entropy: 122.6 bits
Crack time (1T/s): 2.53e+17 years
```