Password Generator — strong, random passwords
Generate a cryptographically secure random password instantly — server-side entropy via Node.js crypto.randomBytes. Choose length (8–128 characters), toggle uppercase, lowercase, numbers, and symbols. See entropy score in bits and copy to clipboard in one click. Free, no signup required.
What makes a password secure?
A secure password has two properties: randomness and length. Randomness means each character is chosen independently from a large pool, with no predictable patterns. Length multiplies the number of possible combinations — every additional character makes brute-force attacks exponentially harder.
Entropy (measured in bits) is the standard way to quantify password strength. A 16-character password using uppercase, lowercase, numbers, and symbols draws from 94 characters — about 104 bits of entropy. This generator uses Node.js crypto.randomBytes, which is seeded by the operating system's cryptographic entropy source, not Math.random().
Frequently asked questions
- Yes. Passwords are generated server-side using Node.js crypto.randomBytes, which reads from the operating system's cryptographically secure pseudorandom number generator (CSPRNG). This is the same entropy source used for TLS key generation. Unlike Math.random(), it is not predictable.
- Entropy (in bits) measures how unpredictable a password is. The formula is: entropy = length × log₂(pool_size). A 16-character password from a 94-character pool (upper + lower + numbers + symbols) has 16 × log₂(94) ≈ 104 bits of entropy. Each additional character adds about 6.5 bits. NIST recommends at least 80 bits for sensitive accounts.
- Generated passwords are temporarily stored linked to a session ID so you can retrieve them from the history list. We do not log passwords to analytics, send them to third parties, or retain them beyond the session. For maximum security, save it immediately in a password manager.
- NIST SP 800-63B recommends at least 8 characters minimum, but for practical security in 2026, use 16+ characters for most accounts and 24+ for critical accounts (email, banking, password manager master password). A 20-character password from all four character sets has about 130 bits of entropy — effectively impossible to brute-force.
Related tools
- → SSL Certificate Checker — verify SSL cert validity, expiry, and chain trust
- → Security Headers Checker — check CSP, HSTS, X-Frame-Options, and more
- → WHOIS Lookup — look up domain registration details and registrar info
Related reading: Website Security Headers — What Each One Does