How it works
Everything happens on the page you loaded. Here is exactly what it does.
Where the randomness comes from
Every character is drawn with crypto.getRandomValues, the cryptographic random number generator built into your browser and fed by your operating system. It is the same source browsers use to create encryption keys. Ordinary Math.random is never used.
Every character is equally likely
Turning random numbers into characters can quietly favour some characters over others. We avoid that with rejection sampling: numbers that would tip the balance are thrown away and drawn again, so each allowed character has exactly the same chance.
Nothing is sent
The generator is a small script that runs on this page. Creating a password makes no network request, so there is nothing to intercept or store. You can check it in your browser’s developer tools, or disconnect from the internet after the page loads: it keeps working.
How strength is calculated
Strength is measured in bits of entropy: the length multiplied by log₂ of the number of possible characters. The time to crack assumes an attacker with dedicated hardware making 100 billion guesses per second. Real attacks on well-protected sites are much slower.
Passphrases and PINs
Passphrases use the Electronic Frontier Foundation’s list of 7,776 words, so each word adds about 12.9 bits. PINs are drawn digit by digit, and patterns people guess first, like repeats, sequences and dates, are skipped when you ask for it.
What we measure
With your permission, Microsoft Clarity shows us how the page is used, such as clicks and scrolling. Passwords, PINs and anything you type into the strength checker are masked and never recorded. See the privacy policy.
Who runs this site
PasswordGen Online is an independent project. There are no accounts and nothing to install. Questions or suggestions: contato@passwordgenonline.com.