When you reach for this instead of a password manager
Password managers are better for most situations — they autofill, detect phishing, and sync across devices. But there are specific cases where a browser-based generator is the right tool: creating a password for a shared account you need to hand to someone else, generating a temporary credential for a contractor who doesn't use your team's password manager, or creating a root account password that you'll write down and store physically in a safe.
In these scenarios, a manager's autofill advantage is irrelevant. What you need is a strong random string, generated privately, without it being stored in any third-party vault. That's what this does. Generate, copy, done — nothing saved anywhere.
Why crypto.getRandomValues() matters
This generator uses the Web Crypto API's crypto.getRandomValues(), which draws from the operating system's cryptographically secure pseudo-random number generator (CSPRNG). This is the same entropy source used by SSL/TLS to generate session keys. It is not Math.random(), which uses a seeded algorithm and is predictable if you know the seed.
Entropy by password length — what "unguessable" actually means in bits:
| Length | Character set (lower+upper+digits+symbols) | Entropy (bits) | Brute-force time at 1 billion guesses/sec |
|---|---|---|---|
| 8 chars | 94 printable ASCII | 52 bits | ~1 hour |
| 12 chars | 94 printable ASCII | 79 bits | ~300 years |
| 16 chars | 94 printable ASCII | 105 bits | universe-scale |
| 20 chars | 94 printable ASCII | 131 bits | universe-scale |
12 characters with all character types is the practical minimum for anything important. 16 is the standard recommendation. Below 10 characters, a well-resourced attacker with a GPU cluster can brute-force a hash in hours.
What a browser generator can't replace
- Phishing protectionPassword managers autofill only on the exact domain the password was saved for. They catch phishing sites automatically. A generated password you paste manually offers no such protection — you'll paste it on a fake site just as easily as the real one.
- Storage and recallThis tool generates and forgets. There is no vault, no sync, no history. Once you close the tab, the password is gone from here. You need to copy it somewhere — ideally a password manager, a secure note, or physical storage.
- Breach monitoringManagers like 1Password and Bitwarden check your passwords against breach databases and alert you when a site you use is compromised. A standalone generator has no visibility into this.
Short version: use this for one-off generation of passwords you'll immediately store somewhere secure. For day-to-day login credentials, use a password manager.
Password requirements by service — what each platform actually needs
Every service has different minimum requirements. A 16-character password with all character types passes all of them — but here's the exact spec for each so you know what the generator settings should be:
| Service | Min length | Max length | Required | Recommended setting |
|---|---|---|---|---|
| Google Account | 8 chars | No limit | Letters + numbers or symbols | 16 chars, all types |
| Apple ID | 8 chars | No limit | 1 uppercase, 1 lowercase, 1 number | 16 chars, all types |
| Microsoft / Outlook | 8 chars | 256 chars | Letters + numbers | 16 chars, all types |
| Facebook / Meta | 6 chars | No stated limit | Mix of characters recommended | 16 chars, all types |
| Amazon | 6 chars | No stated limit | At least 1 number + letter | 16 chars, all types |
| Most banks (UK/US) | 8–12 chars | 16–32 chars | Letters + numbers; symbols often blocked | 12–16 chars, letters + numbers only |
| Corporate / SSO (Okta, Azure AD) | 8 chars | Policy-set | Upper + lower + number + symbol | 16 chars, all types |
| GitHub | 15 chars (with no 2FA) or 8 chars | No limit | Standard mix | 16 chars, all types |
| AWS IAM console password | 8–128 chars | 128 chars | Upper + lower + number + symbol (configurable) | 20 chars, all types |
Note: banks often block special characters like < > & " ' — if a bank password fails, regenerate with symbols disabled and length set to the bank's maximum (usually 16 or 32 characters).