Secure Password Generator Online
Calculator
Security
Password generator
A brand-new password, put together right here in your browser. It is not sent, stored or seen by anyone — not even us.
Your password
No character type selected. Turn on at least one below to build the password.
How strong it is
- Entropy
- — bits
- Alphabet
- — characters
- Rating
- —
Generated with crypto.getRandomValues(), the browser's cryptographic random number generator.
The code runs only on your machine: no network requests, nothing saved.
Smart home: risparmio + sicurezza
Con Imou monitori consumi e sicurezza della casa da un'unica app. Ottimizza bollette e dispositivi.
More Details
How this generator works
The generator builds the password directly in your browser, using crypto.getRandomValues(): the cryptographic random number generator that the browser provides for exactly this purpose. There are no network calls, no saving, no cookies: the password never leaves your device and nobody sees it, not even us. If you close the page, it is gone.
For every character type you select — lowercase, uppercase, numbers, symbols — the password contains at least one of them. The selection uses rejection sampling, a technique that discards excess random values instead of folding them back with a remainder: without this precaution the first characters of the alphabet would come up slightly more often than the others.
What "entropy" means
Entropy measures in bits how unpredictable a password is. It is calculated like this:
bits = length × log2(characters in the alphabet)
A 20-character password drawn from an alphabet of 86 symbols is worth about 128 bits. Each additional bit doubles the number of attempts needed to guess it: the scale is exponential, not linear, and that is why making a password longer matters more than stuffing it with odd symbols.
The thresholds we use for the rating are the conventional ones: below 50 bits weak, from 70 strong, from 100 excellent. The cracking-time estimate assumes one trillion guesses per second, the order of magnitude of an offline attack on dedicated hardware: it is a stated assumption, not a prediction.
Three rules that really matter
- Length first. Twenty random characters hold up better than eight characters full of clever substitutions. Substitutions like p4ssw0rd are the first ones a dictionary attack tries.
- A different password for every service. When a site is breached, the stolen credentials are automatically tried on all the others: this is credential stuffing. Unique passwords limit the damage to a single account.
- You need a place to keep them. Random passwords cannot be remembered: that is their strength. Use your browser's password manager or a dedicated app, and turn on two-factor authentication wherever it is available.
If you want to learn more about when to change them, which accounts to protect first and how to manage Wi-Fi and device passwords, we have written a complete guide: Secure Password Generator: create your password.
