How are passwords generated — are they truly random?

Yes. Passwords are generated using the Web Crypto API (crypto.getRandomValues), which provides cryptographically secure random numbers. This is the same source of randomness used by password managers and security libraries. No Math.random() is used.

What is password entropy and why does it matter?

Entropy measures how unpredictable a password is, expressed in bits. A higher entropy means more possible combinations and a harder brute-force attack. A password with 60+ bits of entropy is considered strong for most purposes; 80+ bits is recommended for high-security accounts.

What is a passphrase and is it more secure than a random password?

A passphrase is a sequence of random words (e.g. correct-horse-battery-staple). Four or more random words provide high entropy while being far easier to remember than a random character string. NIST 800-63B recommends passphrases as a strong and user-friendly authentication method.

Password Generator — Character & Passphrase, NIST 800-63B

Toolsby salesforceapp.tech

App

🕐History ⚙️Settings1d

Password Generator

Generate cryptographically strong passwords or memorable passphrases. Includes entropy analysis and NIST 800-63B compliance.

About the Password Generator

Generates passwords using crypto.getRandomValues() — the browser's cryptographically secure random number generator. The passphrase mode generates memorable multi-word phrases (like "Correct-Horse-Battery-Staple") from a curated 500-word list, offering excellent entropy with high memorability. The NIST SP 800-63B checker validates against modern password guidelines without complexity requirements.

Password Generator

Password Generator is a free, client-side tool designed to help developers with generate cryptographically strong passwords with entropy analysis..

How to Use

Input your data into the primary editor or upload a file.
Adjust any necessary configuration options.
View the output in real-time or click the action button to process.
Copy or download the results securely.

Privacy First

All processing happens directly in your browser. We never send your sensitive data to our servers.

Frequently asked

Related Tools

Regex Tester

Test regular expressions with live highlighting and match details.

JWT Encoder / Decoder

Decode and inspect JSON Web Tokens with claim analysis.

Hash Generator

Compute MD5, SHA-1, SHA-256, SHA-512 hashes and HMAC signatures for text and files.

Data Masker & Anonymizer

Anonymize PII, API keys, Salesforce IDs, JWT tokens, and more with configurable masking profiles.

TOTP Generator

Generate TOTP and HOTP one-time passwords for testing 2FA flows. RFC 6238 compliant.

JWK Inspector

Inspect JWK key sets, decode JWS signed tokens, and analyze JWE encrypted tokens.