Password Generator
Generate strong random passwords with custom length, character sets, and bit entropy meter.
Generate strong, cryptographically secure passwords. Customize length via slider or direct input with live entropy analysis.
Customization Settings
How do I use Password Generator?
Adjust the password length (4–128 characters) and character pools (`A-Z`, `a-z`, `0-9`, `!@#$%^&*`), or click a Quick Preset.
Enable 'Exclude Ambiguous' (`0O1lI`) if users must type the password manually, or generate up to 50 passwords in bulk.
Verify the Shannon/pool entropy score (bits) and click 'Copy' to copy your CSPRNG password.
What features does Password Generator offer?
Cryptographically secure Web Crypto random values
Customizable length (4 to 128 characters)
Bit entropy strength meter & brute-force estimate
100% private in-browser generation — zero network logging
CSPRNG Entropy Calculation (`window.crypto.getRandomValues`) & Brute-Force Resistance
Unlike `Math.random()`, which uses a predictable xorshift128+ PRNG, this tool draws OS-level hardware entropy via the Web Crypto API (`crypto.getRandomValues`).
| Password Configuration | Pool Size (R) | Entropy Bits (E) | Offline GPU Cluster Crack Time (@ 100B Hashes/sec) |
|---|---|---|---|
| 8 chars (lowercase only) | 26 chars | 37.6 bits | ~2 seconds (Weak — vulnerable to instant crack) |
| 12 chars (alphanumeric) | 62 chars | 71.5 bits | ~1,000 years (Fair — standard user accounts) |
| 16 chars (all 4 pools) | 94 chars | 104.9 bits | $>10^{12}$ years (Strong — production credentials) |
| 32 chars (all 4 pools) | 94 chars | 209.7 bits | Cryptographically unbreakable (API keys & secrets) |
Frequently Asked Questions about Password Generator
Why is `Math.random()` unsafe for generating passwords in JavaScript?
`Math.random()` is a non-cryptographic pseudo-random number generator whose internal state can be reconstructed from a few observed outputs. JoyTools exclusively uses `window.crypto.getRandomValues(new Uint32Array(...))`, which is seeded by your operating system's CSPRNG.
How is password entropy calculated in bits?
Entropy is calculated as $E = L \times \log_2(R)$, where $L$ is the password length and $R$ is the size of the active character pool ($R = 26 + 26 + 10 + 32 = 94$ when uppercase, lowercase, digits, and symbols are all enabled). Every additional bit doubles the search space.
When should I enable 'Exclude Ambiguous Characters' (`0O1lI`)?
Enable it when generating Wi-Fi passwords, temporary onboarding credentials, or recovery codes that humans must read off a screen and type on a mobile keyboard without confusing zero (`0`) with capital `O` or one (`1`) with lowercase `l`.
Are generated passwords ever logged, cached, or transmitted over the network?
Never. Passwords are generated in volatile browser RAM via `window.crypto` and discarded the moment you close the tab.
Explore Related Developer Tools
Bcrypt & Argon2 Password Hash Generator & Verifier
Generate cryptographically secure Bcrypt password hashes ($2b$) with custom cost rounds, or test password verification.
UUID v4 / v7 Generator
Generate cryptographically secure UUID v4, time-sorted UUID v7, UUID v1, and deterministic UUID v5 in single or bulk batches.
Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 cryptographic hash digests from text or files.
JWT Decoder
Decode and inspect JSON Web Tokens. View header, payload, signature, and expiration status.
HMAC Signature Generator
Generate and verify HMAC signatures (HMAC-SHA256, HMAC-SHA512) for Stripe, GitHub, Shopify, and Webhook verification.
Stripe Webhook Signature Verifier
Generate and verify Stripe Stripe-Signature (t=timestamp,v1=hex) HMAC-SHA256 webhook headers over ${timestamp}.${raw_body} in browser.