Online Password Generator

Why this tool runs only in your browser

Most password generators work fine — until you stop to think about what’s actually happening. When you generate a password on a server, that server theoretically sees it. For most sites this is probably fine. But “probably” isn’t the certainty you want when setting up your bank account or email.

This generator was built around one principle: the password never leaves your device. Everything runs in JavaScript directly in your browser. The relevant part of the code:

const array = new Uint8Array(length);
crypto.getRandomValues(array);

crypto.getRandomValues() draws entropy from your operating system’s random number generator — the same source used by cryptographic libraries. Close this tab and the password is gone. No logs, no database, no server.

The problem with password “tricks”

For years, security advice sounded like this: take a word, capitalize the first letter, add a number at the end, swap one letter for a symbol. P@ssw0rd type of thing.

Attackers know these tricks. Dictionary attacks don’t just try common words — they try common words with common modifications. P@ssw0rd isn’t a strong password; it’s a weak password in costume.

“Passwords are like underwear: don’t let people see them, change them often, and you shouldn’t share them with strangers.”
— Chris Pirillo

The real shift came with password managers. When you don’t have to remember a password — when it lives securely in Bitwarden, 1Password, or KeePass — there’s no reason not to use something like xK9#mP2$vL5@nQ8 for every account. Generate, copy, store. That’s the entire workflow.

The need to change passwords regularly was one of the original reasons this tool was built. Rotating a password should take 30 seconds, not a headache.

How long is long enough?

Length matters more than complexity. A 20-character lowercase password has more entropy than a 10-character password with all four character types. Both matter, but length wins.

Password	Length	Time to crack
password123	11 chars	< 1 second
JanNovak1985	12 chars	3 hours
Abc123!@#	9 chars	2 days
MyD0g!sF1uffy	13 chars	5 years
Tr$7mK@p9Lq2	12 chars	200+ years
xK9#mP2$vL5@nQ8	15 chars	34,000 years

NIST Special Publication 800-63B recommends a minimum of 8 characters but notes that length is the primary driver of strength — mandatory special character requirements often backfire by making passwords more predictable.

What character types do

• Uppercase (A–Z) — 26 possibilities per position
• Lowercase (a–z) — another 26
• Numbers (0–9) — 10
• Symbols (!@#$%…) — 32+ depending on the character set

At 16 characters with all four types (94 possible values per position): 94¹⁶ ≈ 3.7 × 10³¹ combinations. A modern GPU cluster cracking one billion passwords per second would need longer than the age of the universe.

The case for a password manager

Generating strong passwords is pointless if you reuse them or store them in a passwords.txt on your desktop. Verizon’s Data Breach Investigations Report consistently finds that 81% of breaches involve stolen or weak passwords. The most common reason people reuse passwords: too many accounts to track.

Password managers solve this cleanly:

• Bitwarden — open source, free tier covers most needs, works on all platforms
• 1Password — polished UI, excellent family/team sharing
• KeePass — fully local, no cloud, complete control

When a password leaks

1. Change it immediately on every account where you used it
2. Enable 2FA on the affected account
3. Check Have I Been Pwned — enter your email to see past breaches
4. Review active sessions and revoke anything unfamiliar

Recommendations by account type

Financial accounts

• 16+ characters, all character types
• Unique password, never reused
• 2FA via authenticator app (not SMS)

Email

• 14+ characters — your email resets every other password, making it the crown jewel of your security
• Mandatory 2FA
• Regularly check logged-in devices

Social media

• 12+ characters
• 2FA via authenticator app — SMS-based 2FA is vulnerable to SIM-swapping attacks

Work accounts

• Follow company policy (typically 14+)
• Never use personal passwords on work systems; change immediately when leaving

Common mistakes worth avoiding

Storing passwords in plain text (passwords.txt, notes app, email drafts) — use an encrypted password manager instead.

Sharing passwords via chat or email — use Bitwarden Send or similar secure sharing if you must share at all.

Trusting browsers as your only password manager — browsers improve, but a dedicated manager with a master password offers better encryption and cross-platform support.

FAQ

Is this generator really private?

Yes. Open your browser's developer console (F12) while generating a password and check the Network tab — you'll see zero requests sent. Everything runs locally.

How often should I change passwords?

When there's a reason: a known breach, suspicion of compromise, or after sharing access. NIST no longer recommends mandatory periodic rotation for its own sake — forced frequent changes typically result in weaker, predictable passwords.

Can I use the same password for multiple accounts?

No. One breach exposes every account sharing that password. A password manager makes maintaining unique passwords for hundreds of accounts effortless.

What's stronger — length or complexity?

Length. A 20-character lowercase-only password has more entropy than a 10-character password using all character types. Use both, but prioritize length.

What if I forget a password?

Use a password manager so you only need to remember one master password. For accounts without a manager, most services offer email-based recovery — which is why protecting your email with a strong password and 2FA is non-negotiable.

Password strength statistics

• 81% of business breaches involve stolen or weak passwords (Verizon DBIR)
• 59% of people reuse passwords across multiple accounts
• 23% of the most common passwords can be cracked in under 1 second
• The average user has 100+ online accounts requiring passwords