Password Generator
Generate strong, secure passwords with customizable options and entropy analysis.
✓ Do
- • Use a unique password per account
- • Enable two-factor authentication
- • Use a password manager
- • Use at least 12 characters
✗ Avoid
- • Personal information
- • Dictionary words
- • Obvious sequences (123456)
- • Reusing old passwords
🔒 This tool
- • Uses crypto.getRandomValues()
- • 100% local processing
- • No data is sent anywhere
- • Open source & auditable
Generate strong passwords and check existing ones in the same place
Most password tools either generate or evaluate. This one does both — create a candidate and immediately see its entropy score before you commit to it.
The password engine combines a cryptographically secure generator (Web Crypto API, getRandomValues()) with a strength analyzer that goes beyond simple character-type checks. Generate a random 16-character string, then switch to the strength checker to see its entropy score. Or paste an existing password and get specific feedback about what makes it weak — not a vague 'medium' rating, but entropy numbers and pattern detection.
Why different password strength meters disagree on the same password
Some meters count character types, some check dictionaries, some calculate entropy. The result varies widely for the same input — and some meters are dangerously optimistic.
A password like 'Password1!' scores 'strong' on many basic meters because it has uppercase, lowercase, a number, and a symbol. It's actually in every dictionary attack wordlist because millions of people use that exact pattern. A reliable strength checker looks at predictability patterns, keyboard walks (qwerty, 123456), and common substitutions. This tool uses entropy calculation plus pattern detection to give you an honest score — not a comforting but misleading one.
When to generate vs. when to audit your existing passwords
Use the generator for new accounts. Use the checker to audit existing passwords, especially if you haven't changed them since any known breach year.
If you've been using the same password for three years, there's a real chance it's appeared in a credential dump from one of the dozens of breaches in that period. Check haveibeenpwned.com for breach exposure, then use the generator here to replace any compromised or weak passwords. The strength checker gives you concrete entropy numbers — 80+ bits of entropy makes a password brute-force resistant at current computing capacities.
Password reuse: the risk multiplier that turns one breach into many
Credential stuffing attacks automate reuse exploitation — attackers take credentials from one breach and try them across hundreds of other services.
When a service you use gets breached, attackers sell or publish the credentials. Automated bots then try those email/password combinations against banking sites, email providers, cloud services, and everything else. If you reused the password, they get in — without hacking anything. The only defense is unique passwords per service. Use this generator to create a unique, strong password for every account and store them in a dedicated password manager.