Password generator.

Long and random. Length matters more than symbols: 16 characters from letters and digits carry about 95 bits of entropy, far beyond what any attacker can try. A pattern you can remember is what they try first, so a generator and a password manager beat ingenuity.

The number of bits an attacker has to guess: length times log2 of the pool size, or words times log2 of the word list for a passphrase. Under 36 bits falls to a laptop, 60 to a determined attacker, 80 is comfortable, 128 is forever. The crack time assumes ten billion guesses a second, an offline attack on a fast hash.

A few random words, such as orbit-candle-maple-thirty-ember: easier to type and remember than a string of symbols at the same strength, because the strength comes from how many words the list holds and how many you draw, not from the words being obscure.

From crypto.getRandomValues, the cryptographic generator built into the browser, with rejection sampling so every character or word is equally likely. Math.random is not used anywhere.

Each class you turn on contributes at least one character, and the result is shuffled so those are not always first. That costs a fraction of a bit of entropy and keeps a site's must-have-a-digit rule satisfied.

Set the length and the classes, or switch to a passphrase and set the number of words; a new one is drawn on every change and on New password. Copy it with the icon by the result.

Into a password manager, straight away. The page keeps no history and the password is gone when you leave; nothing is written to storage.

No. The password is drawn and shown entirely in your browser; the page makes no request, and the tool works offline once loaded.

No. The Password generator is free and opens without a sign-in, an account or an install.

From 4 to 128 characters, opening on 16 with upper case, lower case, numbers and symbols all on. A length outside the range is moved to the nearest end.

Yes: turn off the other three kinds of character and keep numbers, and set the length to 4 or more. The result is a string of digits drawn the same way as any other password.

The symbols are the punctuation of a US keyboard: the number-row signs, brackets, braces, slashes, quotes, the comma, the full stop and a few more. The ambiguous-symbols option drops the brackets, slashes, quotes and punctuation that tend to break in shells and forms.

Under 36 bits of entropy is very weak, under 60 weak, under 80 fair, under 128 strong and 128 or more very strong. The number is the length times the log2 of the character pool, which assumes a uniform random draw.

Closest to the Password generator: Password strength checker, Random string generator, .htpasswd generator, bcrypt hash generator. Each opens on its own page, free and in the browser.

The Password generator is one of 20 in its group. The group's page, /tools/security, lists them all.

The tool is free. Its interface is built from shadcn.io's own components (Button, Input, Slider and the rest of the registry under /ui), which come in React, Vue, Svelte and Solid. Pro adds the blocks and templates for the product around it.