How to Use Password Generator
Follow these three steps to process, validate, and export your data locally inside your browser with zero server latency:
Choose a password length (between 8 and 128 characters; 16+ recommended).
Toggle character sets (Uppercase, Lowercase, Numbers, Symbols) and optional "Exclude ambiguous characters" (`0O1lI`).
Click Generate New Password and copy it directly to your clipboard.
Cryptographic Password Generation: Web Crypto CSPRNG & Shannon Entropy Math
True password security depends on unpredictability (entropy), not memorized word substitutions like replacing "E" with "3" or appending "!" to a pet’s name. Modern offline password-cracking rigs equipped with consumer GPUs can evaluate billions of SHA-256 or MD5 candidates per second against leaked password dictionaries and predictable human patterns.
Our Password Generator draws every character index directly from window.crypto.getRandomValues()—your browser’s Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) seeded by OS-level hardware entropy. Simultaneously, it computes exact information-theoretic Shannon entropy in bits using E = L × log₂(R), where L is password length and R is the size of the active character pool.
Why Length Beats Complexity Alone
In the entropy formula E = L × log₂(R), password length (L) is a linear multiplier on the exponent of 2ᴱ, whereas character pool size (R) grows logarithmically. Increasing a password from 8 characters to 16 characters with all character sets enabled doubles the entropy from ~52 bits to ~104.9 bits—increasing the brute-force search space by a factor of 7.9 × 10¹⁵!
Character Pool Size (R) & Bit Entropy Reference Matrix
See how enabling character sets and increasing length scales cryptographic entropy:
| Enabled Character Sets | Pool Size (R) | Bits / Char (log₂ R) | 12-Char Entropy | 16-Char Entropy |
|---|---|---|---|---|
| Digits Only (0–9) | 10 chars | 3.32 bits | 39.9 bits | 53.2 bits |
| Lowercase Only (a–z) | 26 chars | 4.70 bits | 56.4 bits | 75.2 bits |
| Upper + Lowercase | 52 chars | 5.70 bits | 68.4 bits | 91.2 bits |
| Alphanumeric (A–Z, a–z, 0–9) | 62 chars | 5.95 bits | 71.5 bits | 95.3 bits |
| Full Pool (+ Symbols) | 88 chars | 6.46 bits | 77.5 bits | 103.3 bits |
Credential Hygiene & Password Security Best Practices
Follow NIST SP 800-63B and modern security engineering guidelines:
1. Use 16+ Characters for Critical Accounts
NIST RecommendationSet the length slider to at least 16 characters (24+ for database root passwords and JWT signing secrets) to exceed 100 bits of entropy.
2. Enable "Exclude Ambiguous" for Manual Typing
UsabilityIf you need to type a Wi-Fi password on a TV remote or mobile phone, check "Exclude Ambiguous (0/O, 1/l/I)" to prevent look-alike typos.
3. Never Reuse Passwords Across Services
Credential Stuffing DefenseGenerate a unique password for every single website and store it in an encrypted password manager (Bitwarden, 1Password, or Apple/Google Passwords).
4. Zero Network Logging or Persistence
100% Local CSPRNGGenerated passwords exist solely in your browser tab’s volatile React state and are wiped the instant you click Regenerate or close the page.
Practical Examples & Input/Output Reference
20-character mixed password with all character sets
High-entropy password suitable for password managers.
Sample Input
Length: 20, Uppercase + Lowercase + Numbers + SymbolsExpected Output
k9#vR2!mP7$xQ4&nL8@z (~131 bits of entropy)Frequently Asked Questions
Why does this generator use `crypto.getRandomValues` instead of `Math.random()`?
`Math.random()` is not cryptographically secure and can be predictable. `crypto.getRandomValues()` draws entropy from your operating system CSPRNG, and we use rejection sampling to avoid modulo bias.
Are generated passwords saved in localStorage or browser history?
Never. Generated passwords live only in temporary component state in RAM and disappear as soon as you reset or close the tab.