Secure Password Generator & Strength Meter
Generate cryptographically random passwords with entropy scoring and a live strength meter.
—
About This Tool & Technical Logic
Strong passwords are about entropy: bits of genuine randomness. This generator uses the browser's crypto.getRandomValues() — a cryptographic random source — and shows the resulting entropy: log₂(alphabet^length).
Strength bands follow standard thresholds: <40 bits is weak (crackable in hours), 60–80 bits is strong for everyday accounts, and 100+ bits resists nation-state brute force. Length beats character classes: a 20-character lowercase random string outranks an 8-character "complex" one.
entropy = length × log₂(poolSize); strength bands at 40 / 60 / 80 / 100 bits.
How to Use — Step by Step
- 1
Choose length first
16+ for important accounts, 20+ for master passwords. Every character adds real entropy.
- 2
Add character classes as the site allows
Symbols and mixed case widen the pool — helpful, but never a substitute for length.
- 3
Store it in a password manager
Memorizing one generated password is fine; memorizing forty isn't. Managers also stop reuse.
Frequently Asked Questions
Yes — they come from crypto.getRandomValues(), the browser's cryptographic RNG, not Math.random().