Password Generator

What is a Password Generator?

A password generator creates random strings of characters used as passwords for user accounts, API keys, database credentials, and encryption secrets. Unlike human-chosen passwords, generated passwords draw from the full space of possible character combinations, making them resistant to dictionary attacks and pattern-based guessing. This tool generates strong random passwords online using your browser's built-in cryptographic random number generator.

Password strength depends on two factors: length and character diversity. A 20-character password using uppercase, lowercase, digits, and symbols has roughly 131 bits of entropy. At that level, a brute-force attack testing one trillion guesses per second would need longer than the age of the universe to try every combination. The math is straightforward: entropy = length x log2(charset size).

Standards like NIST SP 800-63B recommend passwords of at least 8 characters with no upper limit enforced by the verifier, and discourage forced composition rules such as requiring exactly one symbol, favoring longer passphrases instead. For machine-to-machine credentials and service accounts, 20 or more random characters drawn from a full character set is the accepted baseline in most security frameworks and compliance regimes.

Why Use a Password Generator?

Humans are poor random number generators. We reuse passwords, pick dictionary words, substitute letters with predictable patterns (@ for a, 3 for e), and default to short strings. A password generator removes human bias from the process.

Password Generator Use Cases

Password Entropy Reference

Entropy measures how unpredictable a password is. It is calculated as log2(charset_size ^ length). Higher entropy means more possible combinations for an attacker to search through. NIST and OWASP recommend at least 80 bits of entropy for high-security applications.

Crack times assume 1 trillion guesses per second (offline attack with modern GPUs). Online attacks with rate limiting are orders of magnitude slower.

CSPRNG vs Math.random() for Password Generation

The source of randomness matters as much as password length. A password generated with a predictable random number generator can be reconstructed by an attacker who knows the algorithm and seed state. This tool uses crypto.getRandomValues(), which is a cryptographically secure pseudorandom number generator (CSPRNG) built into every modern browser.

Code Examples

Generate passwords programmatically in different languages. Every example below uses a cryptographically secure random source, not Math.random() or equivalent weak PRNGs.

// Generate a random password in the browser or Node.js 19+
function generatePassword(length = 20) {
  const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*'
  const values = new Uint32Array(length)
  crypto.getRandomValues(values)
  return Array.from(values, v => charset[v % charset.length]).join('')
}

console.log(generatePassword())    // → "kR7!mZp$Xw2&nLq9@Yf3"
console.log(generatePassword(32))  // → "Hd4%tNx!Qw8#mKp2Rv6&Zj0*Ls3Yb7@"

import secrets
import string

def generate_password(length: int = 20) -> str:
    """Generate a cryptographically secure random password."""
    alphabet = string.ascii_letters + string.digits + string.punctuation
    return ''.join(secrets.choice(alphabet) for _ in range(length))

# Single password
print(generate_password())      # → "kR7!mZp$Xw2&nLq9@Yf3"

# Batch of 5 passwords
for _ in range(5):
    print(generate_password(24))

# Ensure at least one char from each category
def generate_strong(length: int = 20) -> str:
    required = [
        secrets.choice(string.ascii_uppercase),
        secrets.choice(string.ascii_lowercase),
        secrets.choice(string.digits),
        secrets.choice(string.punctuation),
    ]
    remaining = length - len(required)
    alphabet = string.ascii_letters + string.digits + string.punctuation
    all_chars = required + [secrets.choice(alphabet) for _ in range(remaining)]
    secrets.SystemRandom().shuffle(all_chars)
    return ''.join(all_chars)

# OpenSSL — generate 32 random bytes, base64-encode
openssl rand -base64 32
# → "x7Kp2mNqR4wZ8vLs1Yb0Hd6tFj3Xc9Ga5eUi+Wo="

# /dev/urandom with tr — alphanumeric + symbols, 20 chars
tr -dc 'A-Za-z0-9!@#$%^&*' < /dev/urandom | head -c 20; echo
# → "kR7!mZp$Xw2&nLq9@Yf3"

# pwgen (install: apt install pwgen / brew install pwgen)
pwgen -sy 20 5
# Generates 5 passwords, 20 chars each, with symbols

package main

import (
    "crypto/rand"
    "fmt"
    "math/big"
)

func generatePassword(length int) (string, error) {
    charset := "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()"
    result := make([]byte, length)
    for i := range result {
        idx, err := rand.Int(rand.Reader, big.NewInt(int64(len(charset))))
        if err != nil {
            return "", err
        }
        result[i] = charset[idx.Int64()]
    }
    return string(result), nil
}

func main() {
    pwd, _ := generatePassword(20)
    fmt.Println(pwd) // → "kR7!mZp$Xw2&nLq9@Yf3"
}

Frequently Asked Questions