Password Generator
The password is created entirely in your browser — it is never sent anywhere.
The Password Generator creates strong, random passwords directly in your browser — from a cryptographic source of randomness, without sending anything to a server. You set the length and character classes, and the entropy bar shows at a glance how strong the password is.
What is a password generator?
Most passwords that end up in criminals’ hands aren’t “cracked” by some clever attack — they were simply too short, too predictable, or reused across multiple sites. A password generator fixes the first of those problems at the source: it assembles a string drawn at random from the full available character pool, with no birth dates, names or keyboard patterns — exactly the things password-cracking tools try first.
The strength of such a password is described by its entropy, expressed in bits — the more bits, the more combinations an attacker would have to try. Each additional character raises entropy faster than adding another character class does, which is why length matters more than complexity. The NIST SP 800-63 guidelines (from the US National Institute of Standards and Technology) have been pointing in exactly this direction for years: long passwords instead of forced letter-digit-symbol combinations rotated every month.
How to use the generator
- Set the length — with the slider or by typing a number in the ‘Length’ field (4 to 2048 characters; a sensible minimum is 16).
- Pick the character classes — lowercase letters, uppercase letters, digits and special characters. The defaults suit most services.
- Optionally narrow the pool — ‘exclude similar’ skips characters that are easy to confuse (o, 0, i, l, 1), while ‘exclude ambiguous’ removes symbols that break in some forms (
~ ; : { } [ ] / \). - Set how many you need — the ‘How many passwords’ field generates up to 100 passwords at once, handy when setting up accounts for a whole team.
- Click ‘Generate’ — copy the password with a single click, or hit the ↻ button to roll a new one.
The bar beneath the password shows its strength along with the entropy in bits. Anything above 80 bits can be considered strong, and above 100 bits — sufficient even for administrative accounts.
Is it safe? Where the password is created
Everything runs client-side, using the cryptographic random number generator built into your browser (the Web Crypto API). The password is never transmitted, stored or logged anywhere — it’s gone the moment you close the tab. That’s a meaningful difference from generators that create passwords server-side, where you have to trust that the operator keeps no records.
Genuine randomness matters in practice. A human asked to invent a “random” password almost always produces predictable patterns, and dictionary-based cracking tools can test billions of such combinations per second. Against a cryptographically random string, all that’s left is brute force — and at sufficient length, that is computationally out of reach.
How to store strong passwords
Nobody can memorise a random 20-character password — and nobody has to. The standard answer is a password manager, which keeps passwords in an encrypted vault and fills them in when you log in; the only thing you memorise is a single master password. That way every account can have a unique password, and a breach at one service doesn’t open the door to the rest.
Two more habits are worth adding. First, two-factor authentication (2FA) wherever it’s available — even a stolen password isn’t enough to log in. Second, uniqueness: data breaches happen all the time, and it’s password reuse, not password weakness, that accounts for most compromised accounts. In corporate environments, the fallout of a compromised account shows up fastest in network traffic — unusual logins and connections are exactly what NDR-class monitoring systems such as Sycope are built to catch.
Frequently asked questions (FAQ)
How long should a secure password be?
For everyday accounts, a sensible minimum is 16 characters drawn from the full character pool. Privileged accounts — admin, banking, your password manager’s master password — deserve 20 characters or more.
Is the generated password sent or stored anywhere?
No. The password is created entirely in your browser using the Web Crypto API and never leaves your device. Once you close the tab, no trace of it remains.
What does password entropy mean?
It’s a measure of unpredictability expressed in bits: a password with 80 bits of entropy has 2^80 possible combinations. Every extra bit doubles the number of attempts a brute-force attack would need.
What are “similar” and “ambiguous” characters?
Similar characters are the ones easily confused when retyping: o, 0, i, l, 1. Ambiguous ones are symbols like ~ ; : { } [ ] / \ that some systems and forms refuse to accept. Both options shrink the character pool — compensate with a slightly longer password.
Which is better: a random password or a passphrase?
Both work, as long as they deliver enough entropy. A random string is the shortest route to high entropy and pairs perfectly with a password manager; a passphrase (several random words) is easier to remember, but it has to be genuinely random — quotes and proverbs don’t qualify.
How often should I change my passwords?
Modern guidance, including NIST SP 800-63, no longer recommends routine rotation every X days — it just leads to weaker, formulaic passwords. Change a password when you suspect it has leaked, or when it has been used in more than one place.
