⚡ 10-second version
Generated at tooladda.online/password-generator.html using your browser's cryptographic random number generator — not Math.random(), which is predictable and has no business anywhere near a password. Nothing is stored, logged, or transmitted.
❗ Important
Any password generator that runs server-side has, by construction, seen your password. This one generates locally with the Web Crypto API. Open your Network panel while you click generate — there is no request, because there is nothing to send.
🧮 Entropy is the only thing that matters (and it's countable)
"Strong password" rules like one uppercase, one number, one symbol measure the wrong thing. What matters is entropy — how many equally-likely possibilities an attacker must search. It's simple arithmetic: bits = length × log₂(alphabet size).
| Password | Looks | Actual entropy | Reality |
|---|---|---|---|
P@ssw0rd! |
Passes every corporate rule ✅ | ~10 bits of real entropy | In every cracking dictionary ever assembled. Broken instantly. |
Tr0ub4dor&3 |
"Complex" | Low | Predictable substitution of a dictionary word. |
| 8 random chars (94-char set) | k7#Rp2$q |
52.4 bits | Hard to remember, moderate strength |
| 4 random words | correct horse battery staple |
51.7 bits | 🎯 Same strength, actually memorable |
| 5 random words | 64.6 bits | Strong and still memorable | |
| 12 random chars | 78.7 bits | Strong | |
| 16 random chars | 104.9 bits | Overkill for anything but a master password |
Read those two middle rows again. Eight random characters and four random words carry essentially identical entropy — 52.4 vs 51.7 bits. One you'll write on a sticky note. The other you can hold in your head.
The catch, and it's the whole catch: the words must be chosen randomly by a machine. Four words you picked because they mean something to you carry a fraction of that entropy, because your associations aren't random.
⚠️ Warning
Substitutions don't help.
a→@,o→0,e→3are the first transformations every cracking tool tries.P@ssw0rdis not meaningfully stronger thanpassword— it's the same dictionary word with a rule applied.
🧭 How it works
✨ What's inside
| ### 🎲 Real CSPRNG `crypto.getRandomValues()`, seeded by the operating system. `Math.random()` is fine for shuffling a playlist and disqualifying for a password. | ### 📝 Passphrase mode Machine-random word selection with configurable word count and separator — the mode that gives you memorable *and* strong instead of choosing one. |
| ### 📊 Honest strength analysis Entropy in bits plus a crack-time estimate, rather than a green bar that turns green because you added `1!` to the end. | ### 🔧 Purpose-built modes API keys, Wi-Fi keys, numeric PINs, and an option to exclude look-alike characters (`0/O`, `1/l/I`) when a human has to retype it. |
🛠️ What to use where
| Situation | Recommendation |
|---|---|
| 🔐 Master password for your vault | 6+ random words. You must remember exactly one password — make it this. |
| 🌐 Individual site logins | 16+ random characters, unique per site, stored in a password manager. |
| 📶 Wi-Fi | Long passphrase — people type it once and share it verbally. |
| 🔑 API keys / secrets | Maximum length the service accepts, characters only. |
| 💳 PIN | Random digits. Not a birth year, not 1234, not 1122. |
| 🖥️ Server / root credentials | 20+ characters, and a different one per host. |
📖 Four steps
1. Open → tooladda.online/password-generator.html
2. Mode → passphrase (memorable) or password (maximum entropy)
3. Length → aim for 70+ bits of entropy; the tool shows the number
4. Copy → straight into your password manager
▶ Generate now — tooladda.online/password-generator.html
💡 Tip
Uniqueness beats complexity. One breached site with a reused password compromises every account sharing it — that's credential stuffing, and it's how most account takeovers actually happen. A merely-decent unique password per site is far safer than one magnificent password everywhere.
💡 Tip
Turn on two-factor authentication wherever it's offered. It defends you even in the case where your password has leaked.
❓ FAQ
Is it free? Is anything stored?
Free, and nothing is stored. No account, no history, no server-side log. Generation is local.
How do I know it's not sending my password somewhere?
Open DevTools → Network, then click generate. There's no request. That's a check you can perform yourself rather than a promise you have to accept.
Is a passphrase really as strong as random characters?
Yes, at comparable entropy — 4 machine-chosen words ≈ 51.7 bits, 8 random characters ≈ 52.4 bits. The essential condition is that the words are chosen randomly, not by you.
How long should a password be?
16+ characters for site logins, or 5–6 random words for anything you must memorise. Target 70+ bits of entropy and stop worrying about symbol requirements.
Should I change passwords every 90 days?
Modern guidance says no — forced rotation pushes people toward predictable variations (Summer2024! → Summer2025!). Change a password when there's a reason to: a breach, a suspicion, or a shared device.
Are the crack-time figures exact?
They're order-of-magnitude estimates under stated assumptions about attacker hardware. Treat them as a scale — "instant" vs "centuries" — not a precise forecast.
Where should I store these?
A password manager. It's the only approach that makes unique-per-site passwords realistic, and unique-per-site is the property that actually protects you.
🔬 Under the hood
-
crypto.getRandomValues()(Web Crypto API) for all randomness — noMath.random()anywhere in the generation path. - Entropy computed from the real alphabet size and length, not a heuristic rule checklist.
- Zero persistence: no history, no localStorage of generated secrets, no network calls.
- Works offline once loaded.
Originally published on ToolAdda, where Password Generator runs free in your browser — nothing is uploaded, nothing leaves your device.
Top comments (0)