Password Generator & Strength Checker

What you can do with this password tool

• Generate cryptographically secure passwords in your browser
• Use Web Crypto randomness — not Math.random()
• Guarantee at least one character from each selected type
• Exclude similar or ambiguous characters when you need easier reading
• Create random passphrases from a local word list
• Check password strength locally with entropy estimates and pattern detection
• Copy one password or a small generated list
• Private by design: passwords are not stored or sent to our servers

What is a password generator?

A password generator produces a secret from a defined pool of characters or words. Instead of inventing a phrase you might reuse elsewhere, you let a computer pick unpredictable symbols. This page is a generator and a strength checker only — it is not a password manager, vault, or cloud backup.

How does a secure password generator work?

This tool uses the Web Crypto API (crypto.getRandomValues()) to draw unbiased random indexes into your enabled character sets. It does not use Math.random(). If a character type is enabled, at least one character from that type is included, remaining characters are drawn from the combined pool, and the result is shuffled with a cryptographic Fisher-Yates shuffle. If secure randomness is unavailable, generation is refused rather than silently weakened.

What makes a password strong?

Strength comes from unpredictability and uniqueness. A long random secret from a large pool is hard to guess. A short password, a dictionary word, a keyboard walk like qwerty, or a reused login is weak even if it contains a symbol. Length, randomness, and using a different secret for each account matter more than a single “special character” rule.

How long should a password be?

Longer passwords are generally more resistant to brute-force guessing. For randomly generated secrets, 16–20 characters is a practical default, and you can go up to 128 here when a system allows it. There is no exact length that is always enough: hashing quality, rate limits, and whether the password already appeared in a leak all change the real-world picture.

Password vs passphrase

A password is usually a dense string of letters, digits, and symbols. A passphrase is several randomly chosen words, which can be easier to type or remember. A random passphrase can be useful when memorability matters. Famous quotes and predictable phrases are not passphrases — this generator selects words at random from a local list and estimates entropy from that pool, not from how English the result sounds.

Why you shouldn't reuse passwords

If one site is breached, reused passwords let attackers try the same secret on email, banking, and work accounts. Generate a unique password for each service and store it in a dedicated password manager. This page will not remember previous secrets for you.

Why random passwords are better

People favor names, years, keyboard rows, and slight mutations of old passwords. Attackers know those habits. A uniformly random generator does not prefer “Summer2026!” over any other string of the same length and pool, which is why random secrets resist guessing better than human-chosen ones of similar appearance.

How is password strength calculated?

For generated passwords, estimated entropy is based on the actual character pool and generation process (required character types plus remaining random draws). For passphrases, it uses the size of the local word list and extra random digits or symbols. For passwords you type yourself, the score is a heuristic: length, character variety, common-password detection, sequences, keyboard patterns, and repetition. It is labeled estimated entropy and password strength score — not a guaranteed crack time.

Is this password generator safe?

The generator uses browser cryptography and keeps secrets in memory for this page only. Safety also depends on your device, browser extensions, clipboard habits, and the site that will store the password. Do not generate secrets on a shared or untrusted computer if you cannot control those factors.

Are generated passwords stored?

No. Toolshelf does not store generated passwords or passwords entered for strength testing. They are not saved to localStorage, sessionStorage, IndexedDB, or cookies. Refreshing the page clears them. There is no password history in this version.

Common ways people use this generator

• New account signups

  Create a long random password before you save it in a password manager. Do not reuse an old favorite.

• Rotating credentials

  Generate a replacement password when a service asks you to update a credential after a policy change.

• Shared workstation hygiene

  Create a throwaway-strong password locally when you do not want a cloud generator to see the value.

• Passphrases for memorability

  When you must remember a secret without a manager, a random multi-word passphrase is usually easier than a short mixed-character string.

• Policy checks

  Paste a candidate password into the strength checker to see length, character variety, sequences, and repetition — without uploading it.

• Teaching good habits

  Show the difference between a common password, a patterned password, and a random 20-character secret using local analysis.

How to generate a password on Toolshelf

1. 1Pick Password or Passphrase, then set length or word count.
2. 2Enable the character types you need. Leave at least one type selected.
3. 3Click Generate, review the local strength estimate, and copy the result into a password manager.

Frequently asked questions

What is a password generator?

A password generator creates random secrets from a character pool or word list. This Toolshelf tool runs entirely in your browser and lets you choose length, character types, and passphrase options.

Are generated passwords secure?

They are generated with cryptographically secure browser randomness and unbiased character selection. Security still depends on length, the character pool, uniqueness, and how the destination service stores the password. This tool does not guarantee that an account cannot be breached.

Does this password generator store my password?

No. Generated passwords and strength-checker input live only in page memory. They are not written to localStorage, cookies, or a database, and they disappear when you refresh or leave the page.

Is my password sent to a server?

No. Generation and strength analysis run locally in JavaScript. The password is not posted to Toolshelf servers, password APIs, or breach-check services.

How long should a strong password be?

Longer is generally better against brute-force guessing. A randomly generated password of 16–20+ characters from a mixed pool is a solid default for most accounts. There is no single length that is “enough” for every threat model.

Should I use uppercase, lowercase, numbers, and symbols?

A mixed character pool increases the search space for random passwords. Mixing types does not rescue a short, common, or patterned password. Length plus true randomness matter more than adding a single symbol.

What is a passphrase?

A passphrase is a secret made of several randomly chosen words, such as orbit-lamp-river-cactus-planet. This tool selects words from a local list using secure randomness. A passphrase is not automatically strong just because it contains multiple words.

What is password entropy?

Entropy is an estimate of how large the search space is, measured in bits. For a uniformly random password it is roughly length × log2(pool size). For human-created passwords the estimate is approximate. This page labels it as estimated entropy, not guaranteed security.

Can I use the generated password for banking?

You can generate a strong random secret here and save it in a reputable password manager. Whether a bank account is safe also depends on the bank’s hashing, MFA, device security, and phishing resistance. This tool is not a password manager and does not store logins.

What makes a password weak?

Common passwords, short length, keyboard walks, sequences, heavy repetition, and reused secrets are weak. A password that looks complex but follows a predictable pattern (Password1!) is still a poor choice.

Related tools

• Regex Tester — test patterns you might use in password-policy expressions.
• JSON Formatter & Minifier — inspect local JSON config without uploading it.
• Text Compare — diff two policy snippets or generated lists.
• UUID Generator — create UUID v4 or v7 identifiers with the same local Web Crypto approach.
• User-Agent Parser — inspect client strings without sending them to a lookup API.
• Unix Timestamp Converter — convert epoch times from the same logs you already trust locally.