Secure Password Generator

Generates genuinely random passwords using the browser's built-in Web Crypto API — the same cryptographic randomness source password managers rely on. Everything happens locally; nothing is transmitted, logged or stored anywhere.

What actually makes a password secure

Two things: length and character set size, which together determine entropy — the number of combinations an attacker actually has to search through. A 16-character password drawing from upper, lower, numbers and symbols sits around 2¹⁰⁴ possible combinations, which stays out of reach of brute force even at a trillion guesses per second, a rate that already assumes serious dedicated cracking hardware.

• 8 characters — the bare acceptable minimum, and crackable in hours on modern hardware even at that
• 12 characters — reasonable for general accounts
• 16 characters — the sensible default for anything that actually matters
• 20+ characters — root passwords, database credentials, API keys — anywhere the blast radius of compromise is large
• 32+ characters — encryption keys, service accounts, anything machine-to-machine that a human never has to type

Practices that actually reduce risk, not just tick a compliance box

• Use a password manager — Bitwarden, 1Password, KeePass, doesn't hugely matter which — and stop reusing passwords across services entirely
• MFA on everything that supports it, especially anything with admin access
• For passwords you genuinely need to remember, a passphrase of several random words beats a shorter "complex" password with substituted characters — more entropy, easier to actually recall
• Rotate service account credentials on a schedule, and immediately after any staff change with access to them
• Credential stuffing — reused passwords from one breach tried against every other service — is one of the most common actual causes of account compromise, not some exotic attack

Why a browser-based generator specifically

This uses crypto.getRandomValues(), a CSPRNG built into every modern browser and seeded from real hardware entropy — fundamentally different from server-side generation, where you're trusting a third party not to log what it generates. The randomness is created on your device and never leaves it, which means there's nothing to intercept.