Password Generator

What this tool does

Password Generator creates cryptographically secure random passwords using the browser’s Web Crypto API, with configurable length, character sets, ambiguous-character exclusion, guaranteed inclusion of every selected set, and exact entropy calculated via inclusion-exclusion, shown alongside realistic crack-time estimates.

A genuinely strong password comes down to two things: enough randomness that no one can guess or brute-force it, and a character pool wide enough to resist dictionary and pattern-based attacks, neither of which a human picking characters "randomly" by hand reliably achieves.

This generator uses crypto.getRandomValues(), the browser’s cryptographically secure random source, with rejection sampling to keep every valid password equally likely, exact entropy calculated via inclusion-exclusion when every character set must appear, and realistic crack-time estimates across four real-world attack scenarios.

How to use Password Generator

1. Pick a Preset, or set Length and character sets (uppercase, lowercase, digits, symbols) manually.
2. Optionally toggle Exclude look-alike characters or add characters to Never use.
3. Set How many passwords to generate more than one at once.
4. Review the Entropy, Strength and crack-time estimates.
5. Copy the password, or copy/download the whole batch.

Tips for better results

• Length matters more than character variety for overall strength; a 20-character password of just lowercase letters has more entropy than an 8-character password mixing every character type.
• "Include every selected set" guarantees at least one character from each enabled set (useful for sites that require it), computed with an exact inclusion-exclusion formula rather than an approximation, so the shown entropy is precise, not estimated.
• Excluding look-alike characters (I, l, 1, O, 0, and similar) is worth enabling for a password you’ll need to type or read aloud, at a small cost to the character pool size.
• The crack-time table assumes the attacker already knows your exact settings and must search the full keyspace; it’s a best-case estimate for the attacker, making it a conservative, trustworthy lower bound on real-world security.

Common use cases

• Generating a strong, unique password for a new account.
• Creating a batch of passwords for multiple new team accounts or test environments at once.
• Generating a PIN or Wi-Fi key using a preset tuned for that specific use case.
• Understanding exactly how much entropy a given password policy actually provides.

Common mistakes to avoid

• Reusing the same generated password across multiple accounts; even a strong individual password loses its value if one breached site exposes it for reuse everywhere else.
• Choosing an unnecessarily short length just because a site’s minimum is low; going well beyond the minimum costs nothing and adds real security margin.
• Assuming any generated password is "unbreakable"; the crack-time table shows this depends heavily on length and pool size, a short password with every character type can still be weaker than a long one with just letters.