Password Generator
Generate cryptographically secure passwords, memorable XKCD passphrases, and PINs with entropy stats.
Hardware Entropy & Modulo Bias Elimination
Standard pseudorandom generators like Math.random() use predictable mathematical state machines (like xorshift) that can be reverse-engineered by adversaries. In contrast, the Web Cryptography API (window.crypto.getRandomValues) samples true hardware entropy from CPU thermal noise, interrupts, and disk activity.
By rejecting values in the upper uneven window (2³² % range), every character in your pool is mathematically proven to have an exactly equal probability of selection.
No passwords generated yet. Click 'Generate New' to create passwords.
The XKCD #936 Passphrase Revolution
In 2011, webcomic XKCD pointed out that humans choose complex short passwords like 'Tr0ub4dor&3' which are hard to remember but easy for computers to crack (~28 bits). Meanwhile, 4 random common words like 'correct horse battery staple' yield 51+ bits of entropy—effortless for humans, impossible for computers.
You might also like
Frequently Asked Questions
When set to Cryptographic CSPRNG (default), the generator uses the browser's native Web Cryptography API (window.crypto.getRandomValues), sampling physical CPU and hardware entropy. It applies uniform rejection sampling to eliminate modulo bias, ensuring every character in your selected pool has an exactly equal chance of appearing.
No, 100% never. All password generation, entropy math, and crack-time computations execute entirely in your web browser memory. No passwords, seed parameters, or logs are ever transmitted over the network or stored on any server.
Random character passwords (e.g. '8k#Q9!mP2$') rely on high character pool diversity in a short length, which makes them difficult for humans to remember. An XKCD passphrase (e.g. 'Correct-Horse-Battery-Staple') combines 4+ random dictionary words. Because each word contributes ~11 bits of entropy, a 4-word passphrase yields 51+ bits of cryptographic protection—making it effortless for humans to type while remaining practically impossible for computers to brute force.
Entropy is a mathematical measurement of unpredictability expressed in bits. Every additional bit doubles the number of guesses an attacker must test. For everyday consumer accounts, 60–79 bits ('Strong') is recommended. For master passwords, root keys, and financial portals, 80–127 bits ('Very Strong') or 128+ bits ('Quantum-Proof') provides enterprise-grade resistance against nation-state supercomputer clusters.
When taking a random 32-bit integer (0 to 4,294,967,295) and calculating its remainder with an operator (% poolSize), characters at the beginning of the pool appear slightly more often unless 2³² is perfectly divisible by the pool size. Rejection sampling discards raw numbers in that uneven leftover window and redraws, mathematically guaranteeing zero skew.
Yes! The Password Generator is built strictly offline-first. Self-healing service workers cache all necessary assets and scripts on your first visit, enabling full cryptographic password and passphrase generation with zero network connectivity.
Seeded PRNG mode (powered by the 32-bit Mulberry32 algorithm) uses a deterministic recurrence equation derived from a custom seed string. Entering the exact same seed produces the identical sequence of passwords on any computer, which is invaluable for automated testing, QA fixtures, and reproducible simulation pipelines.