Password Generator: Strong Random Passwords

Choose length and character types: each password is drawn with your browser's cryptographic random generator.

Generating a random password: the draw, length and entropy

The generator draws each character with crypto.getRandomValues, the browser's cryptographic randomness source, from an alphabet of 91 signs when all four types are ticked. A 16-character password then carries 104 bits of entropy; at least 13 characters are needed to exceed the 80 bits the French CNIL asks for a password used alone.

This page creates passwords; the site's cracking-time calculator and entropy auditor are for assessing an existing one.

How the draw works

  • Alphabet: 26 uppercase, 26 lowercase, 10 digits and 29 symbols (including ! @ # $ % and brackets), depending on the boxes ticked, so 91 characters at most.
  • The browser supplies one 32-bit random number per requested character; each number, taken modulo the alphabet size, picks a character. The slight bias from the modulo is around 2 × 10^-8, which is negligible.
  • Nothing forces every ticked type to appear. If a site requires at least one digit and there is none, generate again.
  • Length can be set from 6 to 64 characters, 16 by default. A password is created when the page opens and on each click on Generate, not when an option changes.

Entropy by length

Entropy = length × log2(alphabet size). With all 91 characters: 8 characters give 52.1 bits, 12 give 78.1, 13 give 84.6 and 16 give 104.1. Without symbols (62 characters), 16 characters give 95.3 bits.

The strength gauge

The gauge does not measure entropy: it adds one point above 8 characters, one above 12, one for an uppercase letter, one for a digit and one for a symbol, capped at 4. 0 to 1 point: weak; 2: medium; 3: strong; 4: very secure. Lowercase letters score nothing.

Sources and dates: NIST SP 800-63B-4, final version of July 2025: at least 15 characters for a single-factor password, at least 64 characters accepted, no composition rules; CNIL deliberation no. 2022-100 of 21 July 2022: 80 bits of entropy for a password with no additional measure (checked 14/10/2026).

Frequently Asked Questions

Are generated passwords saved on your servers?

No, never. Generation is performed entirely in your browser using cryptographic random number generators. No passwords ever leave your device.

What is the recommended password length?

We recommend at least 16 characters mixing uppercase, lowercase, numbers, and special symbols.

Does the generator use cryptographic randomness?

Yes. Each character comes from a 32-bit random number supplied by crypto.getRandomValues, the browser's cryptographic source, not from Math.random. The number is reduced to the alphabet size with a modulo, which creates a bias of about 2 × 10^-8, with no practical effect.

How many bits of entropy does a 16-character generated password have?

With all four types ticked the alphabet has 91 characters: 16 × log2(91) = 104.1 bits. Without symbols it drops to 95.3 bits. To exceed the 80 bits used by the French CNIL, you need at least 13 characters with all 91 signs.

Is this tool really free?

Yes, all tools on Kristools are 100% free and accessible without registration.

Is my data protected?

Yes. All processing is performed directly and securely inside your browser. No personal data is sent to our servers.