Password Generator: Create Secure Passwords Instantly in Your Browser

You need a strong password. Right now. For a new service account, a database seed, a staging environment secret, or an account you're migrating to your password manager.

The fastest path is usually one of these:

• Open a terminal and run openssl rand -base64 32
• Search "random password generator" and click the first result
• Use your password manager's built-in generator — if you have one open

None of these is great. The terminal command requires a CLI and some mental translation of base64. The first search result often uses Math.random(), which is not cryptographically secure. And the password manager only works when it's open and you're logged in.

Password Generator is the URL you bookmark and share. One click to open, one click to generate, one click to copy. Cryptographically secure. Zero server requests.

What Makes a Password Generator "Secure"?

The Math.random() Problem

Most JavaScript on the web uses Math.random() for anything that needs randomness. It's built-in, convenient, and fast. It's also not appropriate for security-sensitive contexts.

Math.random() is a pseudo-random number generator (PRNG). It produces a sequence that looks random but is fully deterministic given a seed. Different JavaScript engines use different algorithms — V8 uses xorshift128+, for example — but all of them are seeded from a relatively small entropy source at startup. An attacker who knows the PRNG state (or can observe enough outputs to reconstruct it) can predict future values.

This matters for passwords. If an attacker can predict which passwords your generator might produce, brute-force becomes trivially feasible — they don't search the full space, they search the generator's output space.

The Web Crypto API Solution

The Web Crypto API exposes cryptographic primitives to JavaScript that are backed by the operating system's entropy source. window.crypto.getRandomValues() fills a typed array with random bytes sourced from:

• /dev/urandom on Linux and macOS
• CryptGenRandom on Windows

These sources pool entropy from hardware events (CPU timing jitter, network interrupts, device drivers) and are the same sources used by OpenSSL, the kernel's key material generation, and TLS handshakes.

// This is cryptographically secure
const array = new Uint32Array(1);
window.crypto.getRandomValues(array);
const randomValue = array[0] % max;
 
// This is NOT cryptographically secure for passwords
const randomValue = Math.floor(Math.random() * max);

Password Generator uses only getRandomValues(). No Math.random(), no seeded PRNG.

How to Generate a Strong Password

Step 1: Set the Length

Length is the single most important factor in password strength. The relationship is exponential: every additional character multiplies the search space by the size of the character pool.

For most accounts: 16 characters minimum. For high-value accounts (email, banking, master passwords): 24–32 characters. For secrets and API keys: 32–64 characters.

The slider goes from 4 to 128 characters. Type directly in the numeric input for precision.

Step 2: Choose Character Sets

Four sets are available, each independently toggleable:

• Uppercase (A–Z): 26 characters
• Lowercase (a–z): 26 characters
• Numbers (0–9): 10 characters
• Symbols (!@#$%^&*…): 28 characters

For maximum entropy, enable all four. For systems that reject symbols (some legacy corporate systems, some older APIs), disable symbols and increase length to compensate.

The tool prevents you from disabling the last remaining set — you can't accidentally generate from an empty charset.

Step 3: Check the Strength Indicator

The strength meter calculates bits of entropy:

entropy_bits = length × log₂(pool_size)

Where pool_size is the combined character count from all enabled sets.

| Entropy | Rating | |---------|--------| | < 8 chars | Too Short | | < 40 bits | Weak | | 40–60 bits | Fair | | 60–80 bits | Strong | | 80+ bits | Very Strong |

A 16-character password using all four character sets has a pool of 90 characters: entropy = 16 × log₂(90) ≈ 103 bits. That's Very Strong — it would take longer to brute-force than the current age of the universe with today's hardware.

Step 4: Copy and Use

Click the copy button to send the password to your clipboard. For a single password, the large copy button in the output card does it. For bulk passwords, each row has its own copy button, and "Copy All" joins them with newlines.

Bulk Password Generation

The count slider (1–50) is the feature that makes this tool genuinely useful for developer workflows.

Database seeding: Generate 20 user passwords at once, copy all, paste into a seed CSV. Each password is independently random — no shared seed, no correlation between outputs.

Batch account setup: Creating service accounts for a new environment? Generate passwords for each at once rather than going back and forth.

Test fixtures: E2E tests often need test users with known credentials. Generate a batch, paste into your fixture file, done.

Verified Private: Zero Network Requests

Open DevTools → Network tab → generate passwords → watch: zero requests. The tool makes no calls to any external service. Your passwords stay on your device. The page source is the complete implementation.

This is verifiable, not just a claim.

Use Cases

Developers

• Generate API keys and signing secrets for new services
• Seed databases with realistic (but secure) test passwords
• Create SSH passphrases that meet complexity requirements

IT and DevOps

• Set up service accounts without reusing passwords
• Generate temporary credentials for contractor access
• Create strong passwords for shared infrastructure

Security Teams

• Demonstrate password entropy to non-technical stakeholders
• Generate compliant passwords for policy audits
• Show why "P@ssw0rd1!" (56 bits) is weaker than "dkf93mxq" at length 20 (119 bits)

Everyone Else

• Set up a strong master password for your password manager
• Create a secure recovery email password
• Generate a Wi-Fi password for guests that you can actually forget when they leave

Frequently Asked Questions

Does this tool work offline?

Yes. Once the page is loaded, all generation is local JavaScript. You can go offline and continue generating passwords. There are no API calls to validate or fetch anything.

Is the entropy calculation accurate?

It's a theoretical upper bound, not a practical crackability estimate. It assumes the attacker knows the exact character pool but not the specific password. In practice, character set restrictions (all symbols only from a specific set) may reduce entropy slightly from the theoretical maximum. The calculation is length × log₂(pool_size) — standard information-theoretic entropy.

Can I use this for master passwords?

Yes, but consider memorability. A 20-character random password is very strong but hard to memorize. If you need to type it from memory, consider using a passphrase generator instead (multiple random words). If you'll paste it from a password manager, use the full random password.

What's the maximum length?

128 characters. This covers every use case from standard account passwords to HMAC signing keys and random seeds for cryptographic operations.

Do you store any data?

No. The tool has no backend, no database, no analytics beyond Google Analytics page views (which don't capture password values or settings). Your password configuration and generated passwords are never transmitted anywhere.

Generate your first secure password now: password-generator.tools.jagodana.com

Built as part of the 365 Tools Challenge — one useful developer tool, every day.