Password Generator
Generate a cryptographically secure random password with your choice of length and character sets.
How It's Calculated
Formula
H = L \times \log_2(N)This generator builds a password by drawing each character independently and uniformly from your selected character sets (uppercase, lowercase, numbers, symbols), using the browser's cryptographically secure random number generator (Web Crypto's crypto.getRandomValues) with unbiased rejection sampling — never Math.random, which is not suitable for generating secrets. The reported entropy is a theoretical character-space estimate (length x log2(pool size)): it measures how large the space of possible passwords is, not how resistant a specific password is to dictionary or pattern-aware attacks. Nothing generated here is stored, logged, or transmitted; the result disappears when you generate a new one or leave the page.
Worked Examples
12-character password, letters and numbers only
- Pool size = 26 (uppercase) + 26 (lowercase) + 10 (numbers) = 62.
- Each of the 12 positions is drawn independently and uniformly from that 62-character pool.
- Entropy = 12 x log2(62) ≈ 71.4 bits.
Frequently Asked Questions
Is Math.random() used anywhere in this generator?
No. Every random character is drawn using the Web Crypto API's crypto.getRandomValues(), a cryptographically secure random number generator. Math.random() is not cryptographically secure and is never used for password generation here.
Does changing a setting regenerate my password?
No. A password is generated only when you click "Generate Password." Changing the length or character sets afterward does not change the displayed password until you click the button again.
Is my generated password saved anywhere?
No. The generated password is never written to local storage, never included in a shareable link, and never sent over the network. It exists only in the page until you generate a new one or navigate away.
What does the entropy number mean?
It is a theoretical estimate of the size of the character space (length x log2(pool size)), not a guarantee of real-world strength. A short password from a large pool can still be a weak, memorable pattern an attacker could guess before exhausting the full character space.