Strong passwords start with real randomness. This generator uses your browser’s cryptographic random source — the same kind of entropy your bank’s site relies on — to build passwords from exactly the character sets you pick, with no modulo bias, no phone-home, and a live entropy readout so you can see strength change as you adjust the settings.
How it works
Every character is drawn from your browser’s crypto.getRandomValues source with rejection sampling, which keeps the distribution perfectly uniform — naive generators that use modulo math subtly favor some characters over others, shaving real entropy off the result. The tool guarantees at least one character from every set you enable (so “I want symbols” always produces symbols), then shuffles so the guaranteed picks don’t sit in predictable positions. The entropy readout is the honest math: length × log₂(pool size) — the actual measure of how hard a password is to brute-force.
What makes a password strong
Length beats cleverness. A 16-character mixed password carries about 95 bits of entropy — beyond any realistic brute-force attack. Substituting “@” for “a” in a dictionary word, by contrast, adds a couple of bits at best, which is why “P@ssw0rd!” still falls in seconds. A random 12-character password with all four sets (~72 bits) is already far past anything an offline attacker can crack in a human lifetime at today’s speeds. The “avoid look-alikes” option trades a little entropy for readability when you’ll be typing the password by hand.
Everything runs locally in your browser — generated passwords never touch a server, and there’s nothing stored. Pair this with a password manager: one strong random password for the manager itself, and let it remember the rest. Built in-house in plain JavaScript.