Password & PIN Generator

Humans are terrible at inventing randomness - even when we swap E for 3 and tack an exclamation mark onto the end of a pet's name, password cracking rigs guess those patterns in milliseconds. This cryptographic password generator uses your browser's hardware-seeded window.crypto.getRandomValues() CSPRNG to generate random character passwords, multi-word memorable passphrases, and numeric PINs, displaying the exact Shannon/pool entropy in bits and estimated brute-force crack resistance.

Why browser CSPRNG beats human "cleverness" and Math.random()

When a developer writes a quick password script using JavaScript's standard Math.random(), the numbers come from a predictable pseudo-random algorithm (xorshift128+) that is explicitly not cryptographically secure. Worse, when people make up passwords in their heads, they draw from a tiny pool of keyboard walks, years, and common words.

True security comes from uniform cryptographic randomness (window.crypto.getRandomValues) across a known character or word pool:

• Database and cloud IAM root credentials: Generating 24- to 32-character high-entropy strings (>150 bits) for AWS root accounts, PostgreSQL production users, and .env JWT secrets.
• Master passwords you actually have to type: Switching to Memorable Passphrase Mode to generate 5 or 6 random words separated by hyphens (such as velvet-anchor-timber-glacier-cobalt) that are easy to type on a phone or TV remote while still packing massive combinatoric entropy.
• Legacy corporate portals with strict symbol rules: Toggling specific character sets and excluding lookalike characters (0, O, 1, l, I) when you have to read a temporary password aloud or transcribe it onto a secondary device.
• Hardware lock and SIM card PINs: Generating unbiased 4- to 12-digit numeric PINs without falling into human habits like birth years (199X) or repeating digits.

How to generate a password, passphrase, or PIN step by step

Method 1: High-Entropy Random Character Passwords (for Password Managers & API Secrets)

1. Select Random Password mode: Keep the top mode switch on Random Password for maximum bit density per character.
2. Set your character length: Drag the length slider between 12 and 64 characters (16–24 characters is ideal for web vaults; 32+ for .env signing keys and database root users).
3. Customize character pools & ambiguity rules: Toggle Uppercase (A–Z), Lowercase (a–z), Numbers (0–9), and **Symbols (!@#$%^&*). Enable Exclude Ambiguous (0, O, 1, l, I)** if you ever have to read or type the credential onto another screen.
4. Verify bits of entropy and copy: Check the live Entropy (bits) badge (E = L × log2(N)) and click Copy Password (or generate a bulk batch list for provisioning multiple accounts).

Method 2: Multi-Word Memorable Passphrases (for Master Passwords & Disk Encryption)

1. Switch to Memorable Passphrase mode: Click the Passphrase tab when creating a Bitwarden/1Password master password, FileVault/BitLocker boot secret, or SSH key phrase that you must type from memory.
2. Choose word count (3 to 10 words): Slide the counter to 5 or 6 random dictionary words for strong offline crack resistance without frustrating symbol typos on phone keyboards.
3. Format separators and casing: Pick your preferred word delimiter (Hyphen -, Period ., Underscore _, or Space) and toggle Capitalize Words or Append Number if a corporate form requires uppercase/digit compliance.

Method 3: Unbiased Cryptographic Numeric PINs (for Hardware Locks & SIM Cards)

1. Select Numeric PIN mode: Click the PIN tab to sample digits strictly from window.crypto.getRandomValues() without human date biases (199X) or keyboard patterns.
2. Pick your digit length (4 to 16 digits): Choose 4 or 6 digits for device lock screens and banking cards, or 8–12 digits for high-security hardware tokens, then copy in one click.

How the math and security features work

True Web Crypto API (crypto.getRandomValues) sampling

Every character index is drawn from a Uint32Array populated by your operating system's cryptographic entropy pool via window.crypto.getRandomValues(). It never uses Math.random().

Transparent pool-entropy calculation (E = L × log2(N))

Instead of vague "Weak / Medium / Strong" marketing labels, the tool computes the mathematical pool entropy in bits:

• L = password length (or word count)
• N = size of the active character pool (26 lowercase + 26 uppercase + 10 digits + 26 symbols = 88 possible characters per slot)
• Formula: Bits of Entropy = L × log2(N)

Ambiguous character exclusion (0/O, 1/l/I)

In many sans-serif UI fonts, a capital I, a lowercase l, and the number 1 are pixel-for-pixel identical. Turning on Exclude Ambiguous Characters removes 0, O, o, 1, l, I, | from the pool so you never get locked out when typing a password onto a server console or smart TV.

A real example: comparing a 12-character password vs a 20-character password

Let's run the exact entropy arithmetic for two random passwords using all four character sets (A–Z, a–z, 0–9, and 26 symbols = pool size N = 88, where log2(88) ≈ 6.459 bits per character):

1. 12-character full-charset password:

• Pool size N = 88, Length L = 12
• Entropy: 12 × 6.4594 = 77.5 bits
• Total combinations: 2^77.5 ≈ 2.16 × 10^23
• Against an offline GPU cluster testing 100 billion (10^11) hashes per second, 77.5 bits already takes over 34,000 years on average (50% search space).

1. 20-character alphanumeric-only password (no symbols, Ambiguous Excluded):

• Pool size N = 55 (62 alphanumeric minus 7 ambiguous chars), where log2(55) ≈ 5.781 bits per character
• Entropy: 20 × 5.7814 = 115.6 bits
• Even without special symbols, increasing length from 12 to 20 characters multiplies the search space by a factor of 280 billion (2^38.1), making it far stronger and easier to double-click and copy.

Practical tips and limitations

• Length beats complexity tricks every time: Adding 4 extra characters to a password adds ~25 bits of entropy (33 million× harder to brute-force), whereas enabling symbols on a short 8-character password only adds ~3 bits (8×). Aim for 16+ characters whenever the site allows it.
• Never reuse a generated password across two websites: Even a 128-bit random password will compromise your email if you reuse it on a third-party forum that suffers a plaintext database breach. Store each generated string in a reputable password manager (such as Bitwarden, 1Password, or Apple/Google Password Manager).

Privacy and network transparency

In Random Password and Numeric PIN modes, generation happens 100% locally inside your browser using window.crypto.getRandomValues() with zero network activity. When you switch to Memorable Passphrase mode, the tool may fetch public dictionary word lists from random-word-api / api.datamuse.com (with a built-in local dictionary fallback if offline) and selects words locally using Web Crypto randomness; your generated passphrase is never transmitted or logged anywhere.

Comparing random character strings vs multi-word passphrases

Different security scenarios call for different credential formats depending on whether a password manager types the secret or a human types it by hand:

• Vault-autofilled web & API secrets (20–32 random characters): When your browser password manager or .env configuration stores and pastes the string automatically, a 24-character full-charset password (~155 bits of entropy) fits into compact database fields and satisfies legacy corporate regex validators that demand at least one uppercase letter, digit, and symbol.
• Human-typed master passwords & disk encryption (5–7 random words): For your Bitwarden/1Password master password, FileVault/BitLocker boot screen, or SSH key passphrase that you type from memory every morning, a 6-word hyphenated passphrase (e.g., harbor-velvet-quartz-meadow-falcon-cinder) avoids frustrating symbol typos on mobile keyboards while providing massive resistance against offline cracking.

Related tools

Want to lock a confidential PDF document using your newly generated password? Open Password Protect PDF. Developers can also inspect or encode tokens with Encoder / Decoder and strip leaked Bearer credentials from network logs using HAR File Sanitizer. Read our guide on how to generate secure passwords online.