Strong Password Generator

No. Everything runs entirely in your browser. No passwords, no settings, no history is ever sent to a server or stored in cookies. Close the tab and they're gone forever.

This tool uses window.crypto.getRandomValues() — the same Web Crypto API used by browsers for TLS and security operations. Unlike Math.random() which is predictable, crypto.getRandomValues() uses hardware entropy sources and cannot be predicted or reversed.

Both are strong if done right. A random 20-char password with all character types gives ~130 bits of entropy and is virtually uncrackable. A 5-word passphrase from a large wordlist gives ~65 bits — still very strong, but more memorable. Use a random password for accounts in a password manager; use a passphrase for the master password you need to remember.

We assume an attacker with 10 billion guesses per second — roughly the capability of a high-end GPU rig performing offline hash cracking. The time is calculated as 2^(entropy bits) / 10,000,000,000 seconds. Modern online services are rate-limited to far fewer attempts, making even "fair" passwords practically safe there — but offline cracking of leaked hashes is the real threat.

If you ever need to type a password manually (e.g., on a TV or gaming console), visually ambiguous characters like lowercase L and number 1, or capital O and zero, cause typos. Excluding them doesn't meaningfully reduce security for passwords longer than 12 characters.