deftools.io Security

Password Generator

Generate strong cryptographically secure passwords, memorable passphrases, and PINs — bulk mode, copy-ready, deep-link sharing.

20
Presets
Recent (this session only)
No history yet.
Copied!

About this tool

A strong password is one that is too long and random for an attacker to guess by brute force. This generator produces three kinds: random passwords (mixed letters, digits, symbols), passphrases (several unrelated words joined by a separator — easier to type and remember), and PINs (digits only, for device locks).

All randomness comes from the browser's crypto.getRandomValues API, the same source used for TLS keys — not Math.random. The strength meter shows the entropy in bits and estimates how long an offline attack would take at roughly 1011 guesses per second (a fast GPU rig).

Example: a 20-character random password using upper, lower, digits, and symbols has about 131 bits of entropy and would take trillions of years to crack offline. A 4-word passphrase like camel-violet-grape-engine has about 51 bits — strong enough for most online accounts and far easier to remember.

FAQ

Should I use a random password or a passphrase?

Random passwords are stronger per character but harder to remember and type. Passphrases (4–6 unrelated words) are easier to memorise and long enough to resist brute force. For a password manager vault, use a passphrase; for individual accounts stored in a manager, use a random password.

How is the crack time calculated?

The tool takes the entropy (bits) and computes 2<sup>entropy−1</sup> as the average number of guesses needed, then divides by 10<sup>11</sup> guesses per second. This models a worst-case offline attack where the attacker has the hashed password file and fast hardware. Online attacks against a live login are vastly slower.

Are these passwords safe to use?

Yes. They are generated locally in your browser using cryptographically secure randomness and are never transmitted anywhere. The "Recent" list is kept only for the current browser session and is not stored permanently.

What does "exclude ambiguous characters" do?

It removes characters that look similar — <code>0 O o</code>, <code>1 l I |</code> — so the password is easier to read and type manually. Useful when you need to communicate a password verbally or write it down.

How is this different from the Password Strength Meter?

This is the dedicated generator with more options — passphrases, PINs, bulk mode, and deep-link sharing. To check how strong an existing password is, use the Password Strength Meter which analyses entropy and crack time.

Related security tools

Copied!