Hashes/Crypto

Password Generator

Cryptographically random passwords with configurable length and character set.

This generator draws from a cryptographically secure source of randomness (the Web Crypto API) right in your browser. No password ever leaves your device or reaches a server.

How to use it

What makes a password strong

Strength comes from entropy — length and the size of the character set — not from how "complicated" a password looks to a person. A long password made only of lowercase letters is often stronger than a short one mixing every character type.

Where it's supported, turning on two-factor authentication does more for an account's security than relying on password length alone.

Things to keep in mind

Don't reuse the same password across services — a breach on one account shouldn't put the others at risk.

Store passwords in a password manager, not in a text file or notes app.

Article about this tool: Password Generator: what actually makes a password strong

Frequently asked questions

What actually makes a generated password strong?

Length matters more than complexity — a longer password drawn from a large character set has more possible combinations, making it harder to brute-force, even without unusual symbols.

Is it safe to use this to generate passwords for real accounts?

Yes. Passwords are generated locally in your browser using a cryptographically secure random source — nothing is sent to a server or stored anywhere.

Why exclude ambiguous characters like l, 1, O, and 0?

These characters can look identical in some fonts, which makes passwords error-prone to type or read aloud. Excluding them trades a small amount of entropy for fewer transcription mistakes.

Is a passphrase made of words better than random characters?

For passwords stored in a password manager, random characters give higher entropy per character. But for a "master password" that has to be memorized by hand, a passphrase made of several random words is often more practical — it's easier to remember at comparable or higher entropy.

Can I trust a password generator built into a browser or password manager?

Yes, as long as it uses a cryptographically secure source of randomness (the Web Crypto API or equivalent), rather than a plain Math.random() or similar pseudo-random number generators unsuited for security purposes.

Articles: Hashes/Crypto

Hash Generator: how MD5, SHA-1, and SHA-256 differ from each other

Why MD5 is still used to verify file integrity, but not for passwords.

Checksum Verifier: how to check that a file isn't corrupted

Why a matching checksum confirms a file's integrity, but not who created it.

HMAC: how a keyed hash differs from a regular hash

Why a plain SHA-256 doesn't protect against message tampering, but HMAC does.

Bcrypt: why passwords are hashed slowly, not quickly

Why fast SHA-256 is a bad choice for passwords, and slow bcrypt is the right one.

UUID: how identifiers that almost never repeat are generated

Why UUID v4 can be generated independently on millions of machines without collision risk.

AES: how symmetric encryption works

Why the same key both encrypts and decrypts data in AES, and how that differs from asymmetric encryption.

Argon2: why this algorithm won the password hashing competition

How Argon2 defends better against GPU-based attacks than older password hashing algorithms.

Scrypt: why the algorithm needs so much memory

Why scrypt deliberately demands a lot of memory to make cracking on ASIC devices harder.

TOTP: how one-time codes in authenticator apps work

Why the code in Google Authenticator works offline and syncs with the server only via time.

PBKDF2: the oldest key-stretching standard

Why the recommended PBKDF2 iteration count keeps growing every year.

X.509: what's inside an SSL certificate

What exactly the browser checks in a site's certificate before showing the green padlock.

PGP: how public-key and private-key encryption works

Why you can freely share a PGP public key but never the private one.