Random Password Generator

About this tool

Random Password Generator creates cryptographically secure passwords and multi-word passphrases directly on your local device. Using the Web Cryptography API (crypto.getRandomValues), it generates non-deterministic random data that cannot be predicted by external attackers or seed reconstruction.

In addition to character generation, the tool computes real-time mathematical entropy (measured in bits) and estimates the brute-force attack duration required to crack the generated string against distributed high-performance computing clusters.

Key capabilities

• Cryptographic randomness: Generated using browser CSPRNG hardware entropy sources, avoiding weak pseudo-random PRNG implementations like Math.random().
• Flexible character rules: Support for uppercase, lowercase, numerical digits, ASCII punctuation, custom character subsets, and ambiguous glyph exclusions (0, O, l, 1, I).
• Memorable Diceware passphrases: Multi-word passphrases generated from a curated English dictionary for master passwords and disk encryption keys.
• Mathematical entropy calculation: Instant logarithmic calculation of total key-space combinations and strength categorization.
• Batch generation: Generate up to 10 unique passwords simultaneously with bulk clipboard export.
• Local and zero-log: All computations execute inside your client browser sandbox. No strings are transmitted over the network or saved to cookies.

How to use it

Generating a character password

1. Select Random Characters under the Password format heading.
2. Adjust the Password length slider or type a number (16 to 32 characters is recommended for modern web credentials).
3. Toggle the character sets you wish to allow: uppercase letters, lowercase letters, numbers, or symbols.
4. If typing passwords manually on mobile devices or printed sheets, check Exclude ambiguous characters to prevent confusion between 0 and O, or 1 and l.
5. Click Generate new to cycle values, and click Copy to clipboard when satisfied.

Generating a memorable passphrase

1. Select Memorable Passphrase under the Password format heading.
2. Choose your desired Number of words (4 words provide over 50 bits of entropy; 6 words provide over 75 bits).
3. Select a word separator such as hyphens (-), periods (.), or spaces ( ).
4. Optionally enable Append random 2-digit number or Capitalize each word to meet restrictive third-party portal complexity rules.

Technical details & mathematical formulas

How password entropy is calculated

Password entropy measures the uncertainty or unpredictability of a password, expressed in bits. It represents the base-2 logarithm of the total number of possible combinations ($R$) within the chosen search space.

For a character password of length $L$ drawn with replacement from a uniform character pool of size $N$:

Where:

• $L$ = Length of the password (number of characters)
• $N$ = Total number of distinct possible characters in the selected pool

Pool sizes by character set

For example, a 16-character password chosen randomly from the full standard ASCII pool ($N = 94$):

Passphrase entropy formula

For a passphrase composed of $W$ words randomly selected from a dictionary of size $D$:

When appending a random 2-digit numerical suffix (100 possibilities), the additional entropy contributed is:

Entropy benchmark guidelines

Based on National Institute of Standards and Technology (NIST SP 800-63B) password recommendations:

• Under 36 bits: Very weak. Susceptible to immediate online dictionary and offline brute-force attacks.
• 36 to 59 bits: Moderate. Adequate for low-value local accounts, but vulnerable to fast offline hash cracking (e.g., NTLM or unsalted MD5).
• 60 to 79 bits: Strong. Sufficient for standard online user authentication against offline dictionary attacks.
• 80 to 127 bits: Very strong. Beyond the reach of modern offline GPU clusters; suitable for banking and server administrative keys.
• 128+ bits: Cryptographic strength. Equivalent to symmetric cipher key sizes (AES-128); secure against foreseeable quantum or classical computational attacks.

Questions

Why is crypto.getRandomValues() preferred over Math.random()?

Standard JavaScript Math.random() is a pseudo-random number generator (PRNG) typically implemented using algorithms like xorshift128+. It is deterministic and designed solely for speed in simulations and graphics, not security. If an adversary observes a small sequence of numbers generated by Math.random(), they can mathematically reconstruct the internal state and predict every past and future output.

crypto.getRandomValues() interfaces directly with host operating system entropy pools (such as /dev/urandom on Linux and BCryptGenRandom on Windows), guaranteeing non-reproducible, cryptographically secure values (CSPRNG).

Does this password generator store or transmit my passwords?

No. This tool operates entirely within client-side JavaScript inside your browser. No data packets are dispatched to any server, no analytics record the generated values, and no state is written to browser storage or persistent caches.

How long should my password be?

For standard website accounts protected by two-factor authentication, a minimum of 16 characters drawn from mixed character pools is recommended. For critical infrastructure, root accounts, password manager master keys, or cryptocurrency wallets, a minimum of 20 to 24 characters (or a 6-word passphrase) provides robust defense against long-term cryptographic advancements.