How to generate truly secure, high-entropy passwords locally

Weak passwords and reused passwords are still the number one cause of data breaches worldwide. People naturally pick words they can remember, or make simple swaps (like replacing 'E' with '3'). Attackers expect this: NIST's SP 800-63B notes that dictionary words are among the first passwords they try. Meanwhile, automated cracking tools like Hashcat can test billions of combinations per second. To get truly random, high-entropy passwords, you need cryptographic randomness, and that is what the password generator uses.

Understanding Password Entropy Math

Information entropy is measured in bits. Each extra bit of entropy doubles the number of guesses an attacker has to make:

Entropy (bits) = Length × log2(Character Pool Size)

• Lowercase letters only (26 characters): A 10-character password gives only 47 bits of entropy (crackable in seconds on consumer GPUs).
• Full ASCII pool (94 characters): A 16-character password that mixes uppercase, lowercase, numbers and symbols gives 105 bits of entropy. By the maths, that would take thousands of years to crack.

Why Online Password Generators are Dangerous

Many password generator websites create the password on their server and send it to you over the network. That means server access logs, network sniffers and malicious browser extensions can all catch your new master password on the way.

Our generator uses your browser's built-in crypto.getRandomValues(), a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG). It draws on hardware thermal noise and system interrupts, and it makes no network calls at all. If you are setting up accounts in bulk, the bulk password generator produces a whole list the same way.