Password Generator
Generate credentials from cryptographically secure browser randomness.
Generated password
Generated with Web Crypto and whole-candidate rejection sampling. Passwords are never saved.
Browsers cannot suppress screenshots or clipboard previews.
Working notes
Use Password Generator with the boundary visible.
Password Generator creates fresh credentials with browser cryptographic randomness and explicit length and character-class controls.
What is Password Generator?
A password generator creates random strings using a cryptographically secure random number generator (CSPRNG) so the resulting password has no pattern that an attacker could predict or exploit. Strong passwords are the first line of defense against credential-based attacks — brute force, dictionary attacks, and credential stuffing. The entropy of a password (measured in bits) determines how many guesses an attacker needs to crack it. A 20-character password using uppercase, lowercase, digits, and symbols has roughly 130 bits of entropy, which is effectively uncrackable with current hardware. Human-chosen passwords average 20-30 bits of entropy because people reuse patterns, substitute letters predictably (@ for a, 3 for e), and pick short, memorable words. A CSPRNG-based generator eliminates this bias entirely. StackCache uses the browser's crypto.getRandomValues() API, which draws from the operating system's entropy pool — the same source used for TLS key generation. The generated password never leaves your device: it is held in memory, displayed once, and cleared when you navigate away.
When to use it
- Creating credentials for new accounts — generate a unique, high-entropy password for every service and store it in your password manager.
- Rotating compromised credentials — after a breach notification, generate fresh passwords for affected accounts instead of making minor edits to the old one.
- Generating API keys and secrets — when a service needs a shared secret, pre-shared key, or webhook signing key, use the generator with a long length and full character set.
- Setting up service accounts — generate credentials for CI/CD runners, database users, or monitoring agents that never need to be typed by a human.
- Creating passphrases — use a longer length with only lowercase letters and digits for systems that display credentials in logs or do not accept symbols.
How to use it
- 01Set the desired password length. For most accounts, 16-24 characters is strong enough; for cryptographic keys, use 32 or more.
- 02Enable or disable character classes: uppercase letters (A-Z), lowercase letters (a-z), digits (0-9), and symbols.
- 03Optionally edit the symbol set to exclude characters that your destination does not accept (e.g. some systems reject quotes or backslashes).
- 04Generate a fresh batch of passwords. Each is independent and cryptographically random.
- 05Copy your chosen password and store it in a password manager. Do not save it as plaintext in a file or note.
Common mistakes
- Reusing passwords across accounts — a breach at one service exposes every account that shares the same credential. Use a unique password for every service.
- Choosing short passwords — each additional character multiplies the search space. A 12-character password has far less entropy than a 20-character one, even with the same character classes.
- Removing symbols to "simplify" — symbols add roughly 1 extra bit of entropy per character. Removing them requires a longer password to achieve the same security level.
- Writing passwords in plaintext — store generated passwords in a reputable password manager (Bitwarden, 1Password, KeePass), not in sticky notes, spreadsheets, or chat messages.
- Minor edits to old passwords — changing "P@ssw0rd1" to "P@ssw0rd2" is predictable. Always generate a completely new random password.
Synthetic example
Generate one 20-character password
Input
Length: 20 Upper, lower, numbers, symbols
Result
A fresh value is generated locally; documentation never embeds a reusable password.
Password strength by length and character set
| Feature | 12 chars | 16 chars | 20 chars | 24 chars |
|---|---|---|---|---|
| Lowercase only (26) | 56 bits | 75 bits | 94 bits | 113 bits |
| Lower + upper (52) | 68 bits | 91 bits | 114 bits | 137 bits |
| Lower + upper + digits (62) | 71 bits | 95 bits | 119 bits | 143 bits |
| All + symbols (~95) | 79 bits | 105 bits | 131 bits | 158 bits |
Related standards
Limits and data boundary
- Generated passwords are not saved by StackCache.
- Destination-specific forbidden characters or maximum lengths still need to be checked.
Frequently asked questions
- How secure are the generated passwords?
- Passwords are generated using the browser's crypto.getRandomValues() API, which provides cryptographically secure randomness. Entropy is displayed alongside the result.
- Are my passwords stored or sent anywhere?
- No. Passwords are generated locally and held in memory only. They are never sent to a server and are cleared when you leave the page.
- What character classes can I include?
- Uppercase letters, lowercase letters, digits, and a configurable symbol set. You can enable or disable each class and edit the symbol list to match destination requirements.
- How long should my password be?
- NIST recommends at least 8 characters, but 16-24 characters with mixed character classes provides strong protection against brute-force attacks. For cryptographic keys, use 32 or more.
- What is password entropy?
- Entropy measures the unpredictability of a password in bits. Higher entropy means more possible combinations an attacker must try. Each bit doubles the search space.
Keep working