Password Generator

All randomness comes from crypto.getRandomValues(), a cryptographically secure pseudo-random number generator (CSPRNG) built into every modern browser. Passwords are generated entirely in your browser — nothing is ever sent to a server.

Entropy measures how unpredictable a password is. Password entropy is length × log₂(pool size). A 16-character password using all character sets has ~105 bits of entropy — at a trillion guesses per second, brute-forcing it would take longer than the age of the universe. Generally, 80+ bits is considered very strong.

Rejection sampling is used when selecting characters to avoid modulo bias — a subtle flaw where some characters are slightly more likely to appear when the pool size doesn't divide evenly into the random number range. Random values outside the largest multiple of the pool size are discarded and redrawn.

Passphrases (inspired by Diceware) chain random words from a 1,547-word list. Each word contributes ~10.6 bits of entropy. A 4-word passphrase is easy to remember and provides ~42 bits of entropy — often stronger than a shorter complex password, and far more memorable.

Length beats complexity. Adding one more character to a 16-char password increases entropy by ~6.5 bits — equivalent to adding another character set. For passphrases, one more word adds ~10.6 bits.

Link to this tool with values filled in

Everything after the # stays in your browser — it is never sent to a server — so a link like this opens the tool ready to go without the values travelling anywhere but the address bar:

https://crunchify.net/tools/password-generator#length=20&symbols=true&excludeambiguous=true

Join the settings with &, and percent-encode each value so that spaces, newlines and any #, &, = or % inside one do not break the link. Leave a setting out to accept its default. If a setting is not recognised, the page says so rather than quietly ignoring it.

• mode — password or passphrase, defaults to password. A random character string, or words joined by a separator.
• length (also charsorcharacters) — a whole number from 8 to 128, defaults to 16. Character count, in password mode.
• uppercase — true or false, defaults to true. Include A–Z.
• lowercase — true or false, defaults to true. Include a–z.
• digits (also numbers) — true or false, defaults to true. Include 0–9.
• symbols (also special) — true or false, defaults to true. Include punctuation.
• excludeambiguous (also unambiguousornoambiguous) — true or false, defaults to false. Drop 0, O, l, 1 and I, which are easily confused when read aloud or typed.
• words (also wordcount) — a whole number from 1 to 10, defaults to 4. Word count, in passphrase mode.
• separator — text, up to 4 characters, defaults to nothing. Joins the words in passphrase mode. Empty by default.
• capitalize — true or false, defaults to true. Capitalise each word, in passphrase mode.
• digit (also appenddigit) — true or false, defaults to false. Add a random digit to the passphrase.
• symbol (also appendsymbol) — true or false, defaults to false. Add a random symbol to the passphrase.
• padding — prefix or suffix, defaults to suffix. Which end of the passphrase the added digit and symbol go on.

The tool reads these on arrival but never writes them back, so what you type here stays out of your browser history.