Password Generator

When the page loads, this generator calls crypto.getRandomValues(), the Web Crypto API method that draws from a cryptographically secure pseudorandom number generator (CSPRNG) provided by your browser — the same mechanism used for TLS encryption. Unlike Math.random(), which offers no cryptographic guarantee and can be partially predictable, a CSPRNG is designed to resist any attempt to reconstruct its output.

Each character is drawn from the character sets you've enabled (uppercase, lowercase, numbers, symbols). Everything happens in your browser: no generated password is ever sent to a server, stored in a database, or shared with any third party, including the analytics tool used on this site.

A password's entropy is calculated as: entropy (in bits) = length × log2(character set size). It represents, on average, how many attempts a brute-force attack would need to guess the password — each additional bit doubles that effort. This generator draws from up to four sets: 26 uppercase letters, 26 lowercase letters, 10 digits, and 26 symbols.

Example with this tool's default settings (16 characters, uppercase + lowercase + numbers, a pool of 62 characters): entropy is 16 × log2(62) ≈ 95.3 bits, which maps to the “Strong” level shown by the indicator. Enabling symbols at the same length widens the pool to 88 characters and pushes entropy to about 103.3 bits — the “Excellent” level.

The two levers don't carry equal weight. Adding one character with the same 62-character pool multiplies the number of combinations by 62 — going from 16 to 17 characters raises entropy from 95.3 to about 101.2 bits. Widening the character pool at a fixed length has an even stronger compounding effect, since it applies to every position in the password. Either way, length remains the simplest lever to increase without hurting readability.

This tool displays five levels computed from entropy: Weak below 40 bits, Fair between 40 and 60 bits, Good between 60 and 80 bits, Strong between 80 and 100 bits, and Excellent from 100 bits up. These thresholds are recalculated on every generation, based on the chosen length and the active character sets.

NIST (the U.S. National Institute of Standards and Technology), in Special Publication 800-63B, requires a minimum length of 8 characters for a user-chosen password, recommends accepting at least 64, and now advises against mandatory composition rules (forced mixes of uppercase, digits, symbols): length matters more than artificial complexity.

In France, ANSSI (the national cybersecurity agency), in its 2021 guide “Recommandations relatives à l'authentification multifacteur et aux mots de passe” (co-authored with the CNIL, the French data protection authority), recommends a graduated minimum length based on the system's sensitivity level: 9 to 11 characters for low-to-medium sensitivity (about 65 bits of equivalent entropy), 12 to 14 for medium-to-high (about 85 bits), and at least 15 for high-to-very-high (100 bits or more) — the latter also requiring multi-factor authentication. ANSSI calculates these equivalences over a 90-character set (lowercase, uppercase, digits, and a selection of special characters).

For comparison, with all four of this tool's character sets enabled (88 characters at most, close to ANSSI's 90-character reference): 12 characters yield about 77.5 bits of entropy, 15 characters about 96.9 bits, and 16 characters cross the 100-bit mark — consistent with ANSSI's tiers.

ANSSI also describes passphrases as an alternative construction method: randomly picking several words from a defined corpus, such as a language dictionary. At equal entropy, a passphrase is often longer in characters than a “classic” password, but some users find it easier to remember — which is also why ANSSI recommends never imposing an overly low maximum length. This generator produces character-based passwords, not passphrases: if you'd rather remember a sequence of words, that format remains a valid alternative, provided the words are drawn at random rather than chosen for their meaning.

Generating a unique, strong password for every service defeats its purpose if you can't remember any of them. A password manager stores those passwords in encrypted form and asks you to remember only one master password — itself worth making long and unique. It's the most realistic way to apply “a different password per service” without resorting to sticky notes.

Even a high-entropy password won't protect you against phishing, a data breach on the service's side, or a compromised device. Both NIST and ANSSI recommend enabling multi-factor authentication (MFA) wherever it's offered — a one-time code, a security key, or an authenticator app alongside your password. A strong password is still necessary, just no longer sufficient on its own.

Three habits account for most of the risk: reusing the same password across services (a single breach then exposes every account tied to it, through so-called credential-stuffing attacks), picking a password that appears in lists from previous breaches or is based on a dictionary word, and using guessable personal information (birthdates, first names, sequences like “123456” or “qwerty”). A randomly generated password, like the ones this tool produces, avoids all three by construction.