Password Generator

Purpose

Strong password generator with configurable length (8-128), character set (uppercase / lowercase / digits / symbols), exclusion of ambiguous characters (0/O, 1/l/I), and human-readable passphrase mode (correct-horse-battery-staple style). Generates 1-50 passwords at once, with entropy (bits) and brute-force time estimates. Uses crypto.getRandomValues for cryptographically secure randomness. Passwords are never uploaded and disappear on page close.

Steps

1. Set length: 16 chars default (recommended); range 8-128
2. Charset checkboxes: uppercase / lowercase / digits / symbols (!@#$% etc.)
3. Exclude ambiguous: 0/O, 1/l/I/| (easy to confuse)
4. Passphrase mode: 4-6 English words joined by hyphens (correct-horse-battery-staple) — high entropy and memorable
5. Generate count: 1 / 10 / 50 at a time
6. Click Generate for password list
7. See entropy (bits) and brute-force time estimate
8. Copy all or copy individual

FAQ

Is 8 chars enough? How long is secure?

8 is not enough — about 50 bits of entropy, breakable in hours on a single GPU. 16+ is recommended (~100 bits, all global compute centuries to crack). Use 20+ for accounts, encrypted wallets, root accounts. One-time OTP codes can be 6 digits (5-minute expiry).

Should I include symbols? Some sites disallow special chars.

Symbols significantly raise entropy (30+ extra chars per position). But some legacy sites (banks, government) ban symbols or limit length. Prefer longer passwords (20+ alphanumeric > 12 with symbols), then meet site requirements. Disable symbols in charset settings.

Are passphrases actually easier to remember than random chars?

Yes. 20 random characters (X#mP9!qLn@2vK5jH$wR) are nearly impossible to memorize — needs a password manager. 4-word passphrases (correct-horse-battery-staple) form mental images. Entropy: 4 words ≈ 12 random chars; 5 words ≈ 15 random chars. Best for master passwords and wallet seeds.

Are generated passwords logged?

No. crypto.getRandomValues runs in the browser, no network requests fire, the page state is discarded on close. Verify in DevTools Network — no fetch/XHR during operation. Save to 1Password / Bitwarden / KeePass immediately after generation.

Can I reuse the same password across sites?

Never. One site's breach lets attackers credential-stuff your other accounts. Use a unique password per site, stored in a password manager. The "generate 50 at once" mode is for rotating all your accounts.

Use cases

• Account registration: unique strong password per site, stored in a password manager
• Encrypted wallets: 20+ char password or 5-6 word passphrase as the master
• Root / admin accounts: SSH / database admin with 32+ chars
• API keys / token: random string as internal API credentials
• One-time temporary passwords: account reset, invite links with short-lived passwords

Use cases

Account registration (16+ unique per site), wallet master passwords (20+ or passphrase), root accounts (32+), API tokens, OTP. Everyone needs this. Crypto-grade randomness, passphrase mode, entropy estimate, ambiguous-char exclusion are the differentiators. Save to a password manager immediately.