🔑 Password Generator: Cryptographically secure passwords, passphrases, PINs and API keys

⚡ 10-second version

Generated at tooladda.online/password-generator.html using your browser's cryptographic random number generator — not Math.random(), which is predictable and has no business anywhere near a password. Nothing is stored, logged, or transmitted.

❗ Important

Any password generator that runs server-side has, by construction, seen your password. This one generates locally with the Web Crypto API. Open your Network panel while you click generate — there is no request, because there is nothing to send.

🧮 Entropy is the only thing that matters (and it's countable)

"Strong password" rules like one uppercase, one number, one symbol measure the wrong thing. What matters is entropy — how many equally-likely possibilities an attacker must search. It's simple arithmetic: bits = length × log₂(alphabet size).

Read those two middle rows again. Eight random characters and four random words carry essentially identical entropy — 52.4 vs 51.7 bits. One you'll write on a sticky note. The other you can hold in your head.

The catch, and it's the whole catch: the words must be chosen randomly by a machine. Four words you picked because they mean something to you carry a fraction of that entropy, because your associations aren't random.

⚠️ Warning

Substitutions don't help. a→@, o→0, e→3 are the first transformations every cracking tool tries. P@ssw0rd is not meaningfully stronger than password — it's the same dictionary word with a rule applied.

🧭 How it works

✨ What's inside

🛠️ What to use where

📖 Four steps

1.  Open   →  tooladda.online/password-generator.html
2.  Mode   →  passphrase (memorable) or password (maximum entropy)
3.  Length →  aim for 70+ bits of entropy; the tool shows the number
4.  Copy   →  straight into your password manager

▶ Generate now — tooladda.online/password-generator.html

💡 Tip

Uniqueness beats complexity. One breached site with a reused password compromises every account sharing it — that's credential stuffing, and it's how most account takeovers actually happen. A merely-decent unique password per site is far safer than one magnificent password everywhere.

💡 Tip

Turn on two-factor authentication wherever it's offered. It defends you even in the case where your password has leaked.

❓ FAQ

Is it free? Is anything stored?

Free, and nothing is stored. No account, no history, no server-side log. Generation is local.

How do I know it's not sending my password somewhere?

Open DevTools → Network, then click generate. There's no request. That's a check you can perform yourself rather than a promise you have to accept.

Is a passphrase really as strong as random characters?

Yes, at comparable entropy — 4 machine-chosen words ≈ 51.7 bits, 8 random characters ≈ 52.4 bits. The essential condition is that the words are chosen randomly, not by you.

How long should a password be?

16+ characters for site logins, or 5–6 random words for anything you must memorise. Target 70+ bits of entropy and stop worrying about symbol requirements.

Should I change passwords every 90 days?

Modern guidance says no — forced rotation pushes people toward predictable variations (Summer2024! → Summer2025!). Change a password when there's a reason to: a breach, a suspicion, or a shared device.

Are the crack-time figures exact?

They're order-of-magnitude estimates under stated assumptions about attacker hardware. Treat them as a scale — "instant" vs "centuries" — not a precise forecast.

Where should I store these?

A password manager. It's the only approach that makes unique-per-site passwords realistic, and unique-per-site is the property that actually protects you.

🔬 Under the hood

• crypto.getRandomValues() (Web Crypto API) for all randomness — no Math.random() anywhere in the generation path.
• Entropy computed from the real alphabet size and length, not a heuristic rule checklist.
• Zero persistence: no history, no localStorage of generated secrets, no network calls.
• Works offline once loaded.

Originally published on ToolAdda, where Password Generator runs free in your browser — nothing is uploaded, nothing leaves your device.