Password Generator
Generate secure random passwords, pronounceable passwords and PINs with strength analysis.
How Password Generator Works
A password generator builds a secret at random instead of letting a person invent one. People reuse, pattern and predict; a generator does not, so the result resists both guessing and the dictionary and rule based attacks that defeat human-chosen passwords.
Its strength comes from two things only: how many characters are drawn, and how large the set they are drawn from is. Everything below follows from those two numbers.
Passwords are generated using the Web Crypto API (crypto.getRandomValues), which provides cryptographically secure random numbers from the operating system's entropy source.
This is fundamentally different from Math.random(), which uses a predictable pseudo-random algorithm unsuitable for security purposes.
Every character is drawn with the same chance: random numbers that would favour some characters over others are thrown away and drawn again.
- Choose Password or PIN mode using the toggle.
- Under Password, Type chooses Random characters or Pronounceable words: syllables with hyphens between them, one capital letter and one digit, easier to read out and remember. Words sets how many.
- Adjust length and character set options.
- Click Generate or press Ctrl+Enter to create a new password.
- To check an existing password, type or paste it directly into the password field. The password is automatically masked; once shown with the eye, it stays shown while you edit it. Length, character sets, and strength analysis adjust automatically.
- Click the eye icon to reveal or hide the password.
- The circular arrow in the field generates a new one with the current settings, just like Generate.
| Entropy | Randomness in bits. For a generated password it is exact: the bits of every choice made in drawing it. A typed password is also compared against common passwords, words, names, dates and keyboard patterns, and rated by what is left. |
| Brute Force | Estimated time to crack based on the selected attack scenario. Default assumes SHA-256 hashing on an Nvidia RTX 5090 (~28 billion guesses/second). |
| Charset | The number of possible characters per position. More character types = larger charset = stronger password. |
| Attack Scenario | The assumed hash algorithm and attacker hardware. GPU benchmarks based on Nvidia RTX 5090 (Hashcat). Online attacks are rate-limited to ~100 attempts/second. |
The strength analysis goes beyond charset-based entropy: it detects common patterns like repeated characters, sequential runs, keyboard patterns, and low character diversity. These patterns reduce effective entropy because attackers try them first. Switch the attack scenario to compare crack times across different hash algorithms. A typed password that is common, famous or far too short is marked plainly: don't use it.
- Use at least 12 characters for important accounts.
- Never reuse passwords across services.
- Use a password manager to store generated passwords.
- For maximum security, enable all character types including symbols.
A PIN is meant for a device that locks after a few wrong tries, so it is not rated like a password: offline, any PIN is found at once.
Words of three syllables with hyphens between them, one capital letter and one digit: easier to read out and remember than random characters. Each word adds about 20 bits.
Benchmarks: Nvidia RTX 5090 (Hashcat)
| Hash | Hashrate | Crack Time |
|---|---|---|
| MD5 | 221 GH/s | - |
| SHA-256 | 28 GH/s | - |
| bcrypt | 10 kH/s | - |
| Online | 100 H/s | - |