Password generator

Two things generators get wrong

The randomness

Math.random() is not a cryptographic generator. It is a fast pseudo-random function seeded from a small internal state, and in every browser engine its future output can be reconstructed from enough of its past output. It is the right tool for shuffling a carousel and the wrong one for anything that guards an account. This page uses crypto.getRandomValues, which draws from the operating system's own entropy pool — the same source that seeds TLS.

The bias

Having got real random numbers, the usual next line is alphabet[r % alphabet.length]. That is only uniform when the alphabet size divides the range exactly, and it almost never does. Take 26 letters and a single random byte: values 0 to 233 land on the first twenty-two letters four times each, and the remainder three times. Those twenty-two letters come up about a third more often than the rest.

The password still looks random, and the strength number printed beside it is still wrong, because it was calculated for a uniform draw that did not happen. This generator throws away the unusable top of the range and draws again — a few more bytes, and exactly uniform.

Length beats complexity, and it is not close

Every extra character multiplies the work by the size of the alphabet. Every extra rule — a capital, a digit, a symbol — divides the space of allowed passwords instead. That is why Tr0ub4dor&3 is weaker than correct-horse-battery-staple despite looking far more like what a password is supposed to look like.

Concretely, on the alphabet this page uses: eight characters is about 52 bits, twelve is about 78, and twenty is about 130. Nothing brute-forces 130 bits — not now, and not with any amount of hardware. Past roughly 100 bits the length has stopped being the weak part of your security and something else has become it.

Why "must contain one of each" makes it very slightly worse

A rule that says the password must contain a digit removes every password without one from the set of possibilities. Fewer possibilities is less work for an attacker, not more. The loss is small — a fraction of a bit at normal lengths — and the page shows you exactly how much when the option is on. It is on by default only because a great many websites reject passwords that do not satisfy it.

There is a subtler trap underneath it. The usual way to satisfy the rule is to take one character of each type, fill the rest from the alphabet, and shuffle. That does guarantee the types — but it does not make every qualifying password equally likely, because one character of each type got a free slot before the filling began. Work a tiny case by hand and it falls out: on the alphabet a b 1, at four characters, needing a letter and a digit, that construction produces aa11 half again as often as aaa1. A lopsided distribution carries less entropy than an even one over the same set, so the bits printed beside it would be an overstatement — the exact failure this page exists to avoid.

So this one draws a password at random and throws it away if it does not qualify, which is exactly even across the passwords that do. It costs about one extra attempt in ten at twenty characters. The number shown is therefore the number delivered, which is the only reason worth printing a number at all.

When to use a passphrase instead

Use one for anything you have to type from memory: your device login, your password manager's own master password, a wifi key you have to read out to guests. Six words drawn at random from this page's 2,033-word list is about 66 bits and it fits in your head. A 66-bit random string of characters does not.

Six is the floor, not the target. Five words is 55 bits, and the table on this page will tell you plainly that 55 bits is about two days' work for someone who has stolen a badly-stored password database. Seven words is 77 bits and puts you past anything worth attempting. Each extra word costs you a second to type once and multiplies the attacker's work by two thousand.

The catch is the word random. A phrase you thought of is not random, because people do not pick uniformly — they pick words that go together, and an attacker's word list is built from exactly that habit. The words have to be chosen by the machine, which is what happens here.

About the crack times

They are given at three rates rather than one, because the honest answer is that the number depends on something you cannot see: how the website you used the password on stored it. A site that hashed it once with an old fast algorithm and no salt can be attacked at roughly a hundred billion guesses a second on rented hardware. A site using bcrypt or argon2 as intended is nearer ten thousand. Guessing at the login form itself is nearer ten.

You have no control over which of those you are dealing with, and no way to find out until the breach. That asymmetry is the entire argument for length — it is the one variable on your side of the line.

Questions

Is the password sent anywhere?

No. It is generated in your browser, and nothing you do on this page causes a network request — pressing the button a hundred times sends nothing, because there is nowhere for it to go. (The site loads an analytics script when the page opens, as most sites do; it never sees the password, which does not exist until after that has finished.) It is also never written to local storage or a cookie, deliberately: a password saved to disk by the page that made it is worse than pressing the button again.

Can you see what I generated?

No. There is no server behind this page to see it with. It is a static file; the only computer involved is yours.

Should I reuse one strong password everywhere?

No — that turns one site's breach into every site's breach, and breaches are routine. Use a different one per account and a password manager to hold them. Then the only password you have to remember is the manager's, which is exactly the job a passphrase is best at.

Is this safe on a shared computer?

The page is, but the computer may not be. Anything that can read the screen or the keyboard can read a password no matter where it came from. On a machine you do not control, generate it on your phone instead.

More free tools

Unit converter · Time zone converter · Date calculator · Age calculator · BMI calculator

All free, all running entirely in your browser. Built by Maxverse Lab, a software studio in Karachi.