Understand this tool
Prefer long, unique, random passwords
- What the concept means
- A generated password is a sequence sampled from a chosen character alphabet using a cryptographically secure random source.
- Why it exists
- It creates high-entropy credentials without human selection patterns when length and alphabet are chosen appropriately.
- When to use it
- Use it with a password manager and a distinct password for each account.
- What the result means—and does not mean
- Length and character-set size describe possible entropy only if sampling is uniform. Generation does not store, hash, transmit, rotate, or protect the password after it leaves this page.
Entropy comes from unpredictable choices
If each of N characters is chosen uniformly from an alphabet of size A, the ideal search space is A^N and ideal entropy is N × log2(A). Real strength also depends on the random generator, account rate limits, breaches, and how the credential is handled.
A CSPRNG is designed so observed output does not feasibly reveal future output. Mapping random numbers to an alphabet must avoid modulo bias, where some characters become slightly more likely because the random range is not divisible by the alphabet size.
Generation and storage are separate problems
Services should store password verifiers with a suitable password-hashing scheme and unique salts, not reversible Base64 or plain hashes. This browser tool only generates text; the destination service controls storage and authentication policy.
Key concepts
Key concepts
- Password length
- The number of generated characters.
- Character alphabet
- The set from which each character may be selected.
- Entropy
- A measure of uncertainty under stated random assumptions.
- CSPRNG
- A cryptographically secure pseudorandom number generator.
- Modulo bias
- Unequal selection probability caused by naive range mapping.
- Password hashing
- A server-side method for storing password verifiers.
Method or process
How the process works
Generation and storage are separate problems
Services should store password verifiers with a suitable password-hashing scheme and unique salts, not reversible Base64 or plain hashes. This browser tool only generates text; the destination service controls storage and authentication policy.
Compare the concepts
Generating and storing passwords
| Task | Goal | This page |
|---|---|---|
| Generation | Create unpredictable text | Yes, locally |
| Storage | Protect server-side verifiers | No |
| Account protection | Rate limits, MFA, recovery | No |
Common mistakes
Common mistakes
- Reusing one generated password.
- Assuming symbols compensate for very short length.
- Storing passwords in plaintext or Base64.
Edge cases and limits
Edge cases and limits
- Some sites reject certain symbols or lengths.
- A compromised device can expose even well-generated text.