Password Generator

Cryptographically Secure Password Generation

Passwords protect critical accounts, encryption keys, and confidential systems against credential stuffing and brute-force attacks. Generating truly unpredictable passwords requires a cryptographically secure pseudorandom number generator (CSPRNG). This tool generates passwords client-side using the W3C Web Crypto API, meaning generated values remain completely confidential and never transit over the network.

Why Entropy Determines Password Strength

Password strength is fundamentally determined by information entropy, measured in bits ($E$). Entropy represents the difficulty an adversary faces when attempting an exhaustive search of all possible character combinations.

The entropy formula for a uniformly random password is: $$E = L \times \log_2(N)$$

Where:

• $L$ is the length of the password in characters.
• $N$ is the size of the character pool (charset size).

Character Pool	Characters Included	Pool Size ($N$)	Entropy per Character	16-Char Entropy
Lowercase only	a-z	26	~4.70 bits	~75.2 bits
Alphanumeric	a-z, A-Z, 0-9	62	~5.95 bits	~95.3 bits
Full Printable ASCII	a-z, A-Z, 0-9, symbols	94	~6.55 bits	~104.9 bits
High Security (24 chars)	Full Printable ASCII	94	~6.55 bits	~157.3 bits

Passwords with over 80 bits of entropy offer robust protection against online automated attacks. For master passwords protecting password managers, API tokens, or server root credentials, targeting 100+ bits of entropy (16+ characters with mixed sets) is recommended.

---

Best Practices for Password Security

Modern security frameworks like NIST SP 800-63B establish key password guidelines:

• Length over Complexity: A longer password drawn from a standard charset often provides more security than a short password with complex arbitrary substitutions.
• Unique Credentials: Never reuse passwords across services; a breach at one service exposes all shared accounts.
• Ambiguous Characters: Excluding characters such as 0 and O, or 1, l, and I simplifies manual typing on physical keyboards or mobile devices without sacrificing security.
• Password Managers: Use dedicated password managers to generate, store, and autofill 20+ character passwords.

---

Generating Secure Passwords in Code

You can generate cryptographically secure random bytes natively in modern programming environments:

JavaScript (Browser & Node.js)

function generatePassword(length = 20) {
  const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()_+-=[]{}|";
  const randomValues = new Uint32Array(length);
  crypto.getRandomValues(randomValues);
  return Array.from(randomValues, (v) => charset[v % charset.length]).join("");
}

Python (3.6+)

import secrets
import string

def generate_secure_password(length=20):
    chars = string.ascii_letters + string.digits + "!@#$%^&*()_+-="
    return "".join(secrets.choice(chars) for _ in range(length))

Go

package main

import (
    "crypto/rand"
    "math/big"
)

func generatePassword(length int) (string, error) {
    const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*"
    b := make([]byte, length)
    for i := range b {
        n, err := rand.Int(rand.Reader, big.NewInt(int64(len(charset))))
        if err != nil {
            return "", err
        }
        b[i] = charset[n.Int64()]
    }
    return string(b), nil
}