Create strong, cryptographically secure random passwords with a live entropy-based strength meter.
This generator uses crypto.getRandomValues() — the Web Crypto API's cryptographically secure random number generator — rather than Math.random(), which is predictable and unsuitable for anything security-related.
The strength meter shows actual entropy in bits, calculated as length × log₂(character set size) — the real, mathematical measure of how many attempts a brute-force attack would need, rather than a superficial "weak/strong" guess based on whether you used a capital letter.
Entropy measures how unpredictable a password is, calculated as length times the base-2 logarithm of the character set size. Higher entropy means exponentially more possible combinations an attacker would need to try, making the password harder to crack by brute force.
Yes. Passwords are generated using the Web Crypto API's crypto.getRandomValues(), a cryptographically secure random number generator — not Math.random(), which is not suitable for generating passwords or anything security-related.
Length matters more. A 16-character lowercase-only password has more entropy than an 8-character password with mixed case and symbols. That said, combining length with a larger character set (uppercase, numbers, symbols) gives the strongest result.
No. If one site is breached, reused credentials let attackers access your other accounts through credential stuffing. Use a unique password for every account, ideally managed with a password manager.
No. Passwords are generated entirely in your browser using JavaScript. Nothing is sent to a server, logged, or stored anywhere.