Password Generator
Generate cryptographically strong random passwords using your browser's Web Crypto API. Customize length and character types — passwords are generated locally and never sent anywhere.
Frequently Asked Questions
What makes a password cryptographically secure?
Cryptographic security means the password's randomness comes from a source that is computationally unpredictable — not a regular pseudo-random number generator that can theoretically be reproduced if you know the seed. This tool uses the browser's Web Crypto API (window.crypto.getRandomValues), which is the same standard used in encryption libraries. The key properties of a strong password are sufficient length (16+ characters), a large character set (all four types), and true randomness — this tool provides all three.
How long should a password be in 2026?
Security guidance has shifted from complexity rules toward length as the primary defense. A 16-character random password from a full character set would take centuries to brute-force with current hardware. NIST's 2024 Digital Identity Guidelines recommend at least 15 characters for user-created passwords and emphasize length over mandatory symbol requirements. For high-value accounts like banking, email, and work systems, 20+ characters is a reasonable standard. The longer the password, the exponentially longer a brute-force attack takes — going from 12 to 16 characters multiplies the search space by thousands.
Is it safe to generate passwords in a browser?
Yes, when the tool runs entirely client-side without transmitting data. This generator creates passwords using JavaScript that runs only in your browser — no server request is made and no password is stored or logged. You can verify this by turning off your internet connection and running the tool; it works identically offline. The only risk would be if your browser has a malicious extension that intercepts clipboard content. For maximum security, use a password manager to generate and store passwords, and avoid copying sensitive credentials on public or shared computers.