Password Generator
Generate cryptographically secure passwords, right in your browser.
How passwords are generated
Passwords are generated in your browser using the Web Crypto API (window.crypto.getRandomValues). They are never sent to or stored on our servers. Entropy is calculated as length × log₂(character set size) — each additional bit of entropy doubles the number of guesses an attacker would need on average to crack the password.
For developer tooling, see the Encoding Tools, JWT Decoder, and Hash Generator.
Frequently asked questions
- Are these passwords truly random?
- Yes — they're generated using the Web Crypto API (window.crypto.getRandomValues), a cryptographically secure random number generator, with rejection sampling to avoid modulo bias. This is not a pseudo-random Math.random() generator.
- What is entropy?
- Entropy measures unpredictability in bits — each additional bit doubles the number of possible passwords an attacker would need to try. It's calculated as length × log₂(character set size).
- How long should my password be?
- At least 16 characters is a reasonable modern minimum for most accounts — longer is better, and a password manager makes long, unique passwords for every account practical.
- What does 'exclude ambiguous characters' mean?
- It removes characters that are easy to misread or mistype when written down or read aloud: 0 (zero), O (capital o), 1 (one), l (lowercase L), and I (capital i).
- Can I use this via API?
- Yes — every calculator on Stupidly Clever has a matching REST API and MCP tool that runs the same underlying logic.