Password Generator

From ToolzPedia, the free tools encyclopedia
This is one of several utilities. For the full list of utilities, see All tools.

A password generator is a tool that produces a random sequence of characters intended to be hard for an attacker to guess and impractical for them to crack by brute force. The ToolzPedia Password Generator creates passwords entirely inside your web browser using the cryptographically-secure window.crypto.getRandomValues() API. No password you generate here is ever transmitted, logged, or stored on any server, it exists only in the memory of the browser tab that created it.

A common misconception is that "complex-looking" passwords (e.g. P@ssw0rd!) are strong. They are not, modern offline crackers chew through them in seconds because they follow predictable transformations of dictionary words. What actually defeats a cracker is entropy: the number of equally-likely possibilities the password could have been. A 16-character password drawn uniformly from the full printable ASCII set has roughly 105 bits of entropy, which is enough to resist all currently practical offline attacks even after several decades of Moore's-law improvement to hardware.

The generator below lets you choose length and which character classes to include, then produces passwords that meet (or exceed) NIST SP 800-63B guidance for high-value accounts. It also includes a passphrase mode for situations where you will need to type the password manually, passphrases of four or more random words are easier to type accurately on mobile and easier to read aloud to a partner, while still providing 50+ bits of entropy.

Use the tool edit

Password type
Quick strength preset
Length
characters
Character types (at least one required)
How many passwords?
passwords (up to 500)

How to use Password Generator edit

Follow these steps to use the tool:

  1. Choose a type

    Pick Random for maximum security, Memorable for something easier to type, Passphrase for word-based, or PIN for digits only.

  2. Set length and options

    Use a preset (Easy → Insanely strong) or fine-tune length and character types yourself.

  3. Generate

    Hit Generate and instantly get one or many passwords, up to 500 at once.

  4. Copy or download

    Copy individual passwords with one click, copy them all, or download the full list as a .txt file.

Details edit

🔐 100% client-side

Passwords are generated by your browser using window.crypto.getRandomValues(). Nothing is uploaded, logged, or stored. The download button creates the file locally with the Blob API.

For accounts you care about, pair generated passwords with a reputable password manager and two-factor authentication.

Frequently asked questions edit

No. Generation happens entirely in your browser using <code>window.crypto.getRandomValues()</code>. The page does not contain any code that transmits the generated password back to the server.
Because <code>Math.random()</code> is not a cryptographic random number generator. Its output is statistically predictable enough that an attacker who knows roughly when you generated a password could narrow down the candidate space. <code>crypto.getRandomValues()</code> is designed for this purpose.
For an online account where the attacker is rate-limited to roughly one guess per second, 12 random characters is plenty. For data that may be stolen and cracked offline (e.g. an encrypted backup), aim for 20 or more. For passphrases, 4 random words is a sensible floor and 6 words is appropriate for high-value secrets.
Symbols help when length is fixed and small (e.g. 8 characters). They matter much less once you go beyond 14 to 16 characters, because length grows entropy exponentially while adding symbols only adds linearly to the alphabet size.
Some banks (especially older systems) use legacy fixed-width password columns. This is a poor security practice, but the workaround is to generate the longest password they accept. Where possible, prefer the bank's 2FA, biometric, or hardware-key option over relying on the password alone.
No, every click of <b>Generate</b> draws fresh randomness. You cannot recover a previous password by re-generating; if you lose it, you must reset.

Use cases edit

New account signup

Generate a unique 20-character password for every new service you sign up to. Paired with a password manager, this means a breach at one site cannot affect any other account you hold.

Rotating an old reused password

If you have been using one password across multiple sites, generate a fresh unique password per site and replace them one by one, starting with email and banking.

Wi-Fi network passphrase

Use passphrase mode to generate something like <code>cinnamon-anchor-orbit-veneer</code>, easy to read aloud to guests, hard to brute force.

Database root passwords / SSH keys

For machine-to-machine credentials that are stored in a vault and never typed, use 32+ random characters from the full set.

Temporary share password

When sending a sensitive file via a service that requires a password, generate a one-time string here rather than reusing anything from a real account.

How it works edit

When you click Generate, the tool calls crypto.getRandomValues(), which is the browser's interface to the operating-system entropy pool. On macOS and Linux this comes from /dev/urandom; on Windows it comes from BCryptGenRandom. These sources are designed for cryptographic use and are continuously reseeded from physical noise (mouse movement, network jitter, disk timing).

For each character position in the requested length, the tool draws a random integer modulo the size of the chosen alphabet and indexes into that alphabet. Importantly, the implementation uses a rejection-sampling approach: any random integer that would cause uneven distribution (due to the size of the alphabet not dividing the random range evenly) is discarded and a fresh integer is drawn. This guarantees that every character in the output is uniformly distributed, which is what makes the entropy claim valid.

Passphrase mode draws words from the EFF "long" wordlist (7,776 words). Each randomly-chosen word contributes log₂(7776) ≈ 12.9 bits of entropy, so a four-word phrase has roughly 51.6 bits, about the strength of an eight-character random ASCII password, but far easier for a human to remember and type.

Tips and best practices edit

  • Always store generated passwords in a password manager (Bitwarden, 1Password, KeePassXC, or your browser's built-in one). The whole point of generated passwords is that you do not memorise them.
  • For accounts you must type into a phone keyboard frequently, use the passphrase mode, typo rates are dramatically lower than for symbol-heavy random strings.
  • Length matters more than symbol variety. A 24-character password with only lowercase letters is stronger than a 10-character password with mixed case, digits, and symbols.
  • Do not "personalise" a generated password (e.g. by appending your initials or a memorable year). Every such modification reduces entropy and undoes the whole point of generating it randomly.
  • For high-value accounts (primary email, banking, password manager itself), pair the generated password with a hardware security key or TOTP app for two-factor authentication.

Common mistakes edit

Reusing the generated password across multiple sites

The entire benefit of randomness is per-account isolation. A reused password is only as strong as the weakest site that holds it.

Generating then storing in a plain text file

A 30-character random password in <code>passwords.txt</code> on the desktop is, from an attacker's perspective, no different from <code>password123</code>. Use a vault.

Demanding "memorable" generated passwords

A random string is not memorable by design. If you need something to memorise (e.g. the master password for your vault), use passphrase mode with six or more words.

Lowering length to fit a site's outdated limit

If a site refuses passwords longer than 12 characters, take it as a sign their security practices may be poor and consider what data you store there.

Comparison edit

How different password styles compare for an offline attacker with modern hardware (rough estimates, actual numbers depend on the hash function and attacker's budget):

StyleExampleEntropyTime to crack (offline)
Common word + symbolsP@ssw0rd!~14 bitsUnder 1 second
8 random lowercasekqfmwxzj~38 bitsHours
12 random mixedKq8mWx#zJ4!q~78 bitsMillions of years
16 random mixed20+ chars from this tool105+ bitsIndistinguishable from impossible
4-word passphrasecinnamon-anchor-orbit-veneer~52 bitsCenturies

Other free utilities available on ToolzPedia:

See also edit