utilstuff.com
Back to Dev Tools

Secure Password Generator

Generate high-entropy random passwords and memorable multi-word passphrases locally using Web Crypto CSPRNG hardware randomness.

🔐

Secure Password & Passphrase Generator

CSPRNG Hardware Randomness • Rejection Sampling • Fisher-Yates

🔐 Secure Local CSPRNG Generation:
Passwords and passphrases are generated 100% locally in your browser using Web Crypto API hardware random number generators (`crypto.getRandomValues()`). Generated values are never sent over the network, stored, or persisted.
Entropy & Quality: Character positions are uniformly distributed using rejection sampling and Fisher-Yates CSPRNG shuffling to eliminate modulo bias.

How Are These Passwords Generated?

Passwords and passphrases are generated using your browser's cryptographically secure random number generator (CSPRNG), not a predictable pseudo-random source, so the result is suitable for real account security when the length and character set are adequate.

How to Use the Password Generator

  1. Choose Password mode (random characters) or Passphrase mode (random dictionary words).
  2. Set the length or word count, and choose which character classes or separators to include.
  3. Optionally exclude ambiguous characters (like 0/O or l/1) for easier manual entry.
  4. Generate and copy the result — nothing is sent anywhere or stored.

Technical Notes

  • Entropy (measured in bits) reflects how many possible combinations exist, not just length — a longer character set or word list increases entropy faster than length alone.
  • A passphrase built from several random dictionary words can have comparable or greater entropy than a shorter random-character password while being easier to type and remember.
  • This tool never stores, logs, or transmits generated passwords — closing or refreshing the page discards them, so save what you need before leaving.

Frequently Asked Questions

Are these passwords safe to use for real accounts?+

Yes, when they are long enough. They are drawn from the browser's cryptographically secure random generator using rejection sampling to avoid bias, so the only variable is entropy — pick a length and character set, or word count, that gives a comfortable margin.

Is a passphrase weaker than a random-character password?+

Not necessarily. Strength depends on the size of the pool and the number of independent picks, not on how random it looks. Four or five words chosen at random from a large list can match or beat a shorter character password while being far easier to type.

What does the entropy value in bits mean?+

It is the base-2 logarithm of how many equally likely results the generator could have produced. Each additional bit doubles the effort needed to guess the value by brute force; longer outputs and larger character sets or word lists raise it.