Secure · Offline · Crypto-random

Strong Random
Password Generator

Forge passwords that are genuinely random, see their real strength in bits, and watch how long they'd take to crack — all computed on your device.

crypto.getRandomValues 0 data transmitted no bias sampling
Your password
—
Forge controls

Generated locally with the Web Crypto API. Your passwords never touch a server.

Live intel
Characters
18
Pool / pattern
—
Entropy
— bits
Crack time · online
—
Crack time · offline
—
Recent

    What makes a password genuinely strong

    Strength is not about sprinkling in a symbol to satisfy a form. It is about entropy — the number of bits of uncertainty an attacker faces. Every character you add multiplies the search space by the size of the pool it is drawn from, which is exactly what the live readout above measures. A 12‑character password from a 70‑symbol pool carries roughly 73 bits; push the length to 18 and you cross 110 bits, which is firmly in "excellent" territory.

    This generator does not fake randomness with Math.random(), which is predictable. It pulls bytes from crypto.getRandomValues(), the same source browsers use for encryption keys, and uses rejection sampling so that mapping those bytes onto your character pool introduces no statistical bias.

    Reading the crack-time estimates

    The two figures are honest, order‑of‑magnitude estimates. Online assumes a throttled attacker limited to about a thousand guesses per second — typical of a real login page with rate limiting. Offline assumes the attacker has your password hash and can test ten billion guesses per second on a fast GPU, the worst realistic case. If a password survives the offline column for longer than the age of the universe, you are done.

    When to use Pronounceable mode

    Random strings are strongest but painful to read off a screen or type on a phone. Pronounceable mode builds alternating consonant‑vowel syllables — kovrat‑misen‑talu — which your brain can chunk and remember. It carries less entropy per character, so the meter will honestly show a lower number; switch on Harden to bolt a couple of digits and a symbol onto the end and claw some of it back. For a master password you type daily, that trade is usually worth it.

    The look-alike trap

    Nothing is more frustrating than copying a password and not knowing whether that character is a zero or a capital O, a one or a lowercase L. The Exclude look-alikes toggle strips 0 O 1 l from the pool. You lose a tiny amount of entropy and gain a lot of sanity — a sensible default for any password you will ever transcribe by hand.