Is this password generator cryptographically secure?

Yes. Every password uses the browser's built-in crypto.getRandomValues() Web Crypto API — a cryptographically secure pseudorandom number generator (CSPRNG), not Math.random(). Modulo bias is also corrected for, so every character in the pool has an exactly equal chance of being chosen.

Are my generated passwords stored or sent anywhere?

No. Every password is generated entirely client-side in your browser. Nothing is ever transmitted to our servers, and the session history shown on this page lives only in memory — it disappears the moment you refresh or leave the page.

What does the entropy (bits) number mean?

Entropy measures unpredictability. Each additional bit doubles the number of possible passwords an attacker would need to guess. Under 28 bits is very weak, 60+ bits is fair-to-good for most accounts, and 80+ bits is excellent — effectively uncrackable by brute force with current technology.

Should I use a password or a passphrase?

Both are secure if long enough. A random password packs more entropy per character, but a passphrase (several random words) is often easier to type and remember correctly — useful for a master password you'll type by hand, like a password manager unlock code. For everything else, store a long random password in a password manager.

Why offer a require-at-least-one-of-each-type option?

Pure random selection from a combined pool can occasionally produce a password with no symbols even when symbols are enabled. This option guarantees the result, which also helps satisfy strict password policies that some websites enforce.

How long should my password be?

NIST and most security experts now recommend length over complexity: at least 12 characters for everyday accounts, 16+ for important ones, and a unique password for every site. A 20-character random password is effectively uncrackable with current computing power.

What is the difference between this and a password manager?

This tool generates strong passwords; a password manager stores and auto-fills them so you never have to remember or retype them. Use both together: generate a strong unique password here for each account, then save it in a password manager.

Free Password Generator – Secure Passwords & Passphrases

Why You Need a Strong, Unique Password

Data breaches expose billions of password/email combinations every year. If you reuse the same password across multiple sites, a single breach lets attackers try that password on your other accounts — a technique called credential stuffing. A strong, unique password generated for every account is the single most effective thing you can do to protect yourself online, alongside enabling two-factor authentication (2FA) wherever it's offered.

Random Password vs Passphrase vs PIN

Type	Best for	Typical strength	Ease of manual typing
Random Password	Stored in a password manager — most accounts	Highest entropy per character	Hard to type/remember
Memorable Passphrase	Master passwords you type by hand (e.g. password manager unlock)	High entropy with enough words (4+)	Easy — readable, sayable
PIN Code	Phone unlock, card PIN, app lock screens	Limited by length (device-imposed)	Very easy

How This Generator Stays Secure

True cryptographic randomness — uses the Web Crypto API's crypto.getRandomValues(), not Math.random() which is predictable and unsuitable for security purposes
No modulo bias — rejection sampling ensures every character has an exactly equal probability of selection
100% client-side — generation happens entirely in your browser; nothing is ever sent to a server
Nothing persisted — the session history is held only in page memory and disappears on refresh; we never write passwords to localStorage, cookies, or any database

Tips for Managing Your Passwords

Use a password manager (Bitwarden, 1Password, or your browser's built-in one) to store generated passwords — you only need to remember one master password
Enable two-factor authentication (2FA) on every account that offers it, especially email and banking
Never reuse a password across multiple sites — generate a fresh one for each
Change a password immediately if a service you use reports a data breach
Avoid personal information (names, birthdays, pet names) in any password — even a long one

Password Generator

Why You Need a Strong, Unique Password

Random Password vs Passphrase vs PIN

How This Generator Stays Secure

Tips for Managing Your Passwords

Frequently Asked Questions