Micro Tool Yard logo
Tools
Very strong103 bits of entropy
Ad Slot

How it works

  1. Choose a length and character types

    Uppercase, lowercase, numbers, and symbols — toggle any combination on or off.

  2. Read the strength meter

    An entropy estimate updates live as you change the length or character types.

  3. Copy the result

    Copy the generated password, or regenerate a new one with the same settings.

Password Generator creates a random password from whichever character types you choose — uppercase letters, lowercase letters, numbers, and symbols — using the browser's Web Crypto API rather than JavaScript's general-purpose Math.random(), which isn't built to resist the kind of prediction attacks a password generator needs to withstand.

The strength meter estimates entropy — length multiplied by the base-2 logarithm of the character set size — which is the standard way to quantify how many guesses an exhaustive, worst-case brute-force attack would need. A 16-character password drawn from all four character types has meaningfully higher entropy than the same length drawn from lowercase letters alone, since each position has far more possible values to search through.

Nothing about the generated password ever leaves your browser tab — there's no server round trip, no logging, and no persistence beyond the current page session, so refreshing the page (or navigating away) discards it completely.

FAQ

How random is the generated password?
It's generated using the Web Crypto API's crypto.getRandomValues(), a cryptographically secure random number source built into your browser — not Math.random(), which is not designed to be unpredictable enough for security-sensitive uses like passwords.
What does the strength meter measure?
It estimates entropy in bits: length multiplied by the base-2 logarithm of how many possible characters each position could be. More length and more character types both increase entropy, which measures how many guesses an attacker would need in the worst case, not any particular password's memorability or real-world crackability.
What does "exclude ambiguous characters" do?
It removes characters that are easy to misread or mistype when copying a password by hand — 0/O, 1/l/I, and | — at a small cost to entropy, useful when a password needs to be typed rather than pasted.
Is the generated password sent anywhere?
No. The password is generated and stored only in your browser tab's memory — it's never transmitted anywhere, and closing or refreshing the page discards it completely.