Password Generator

Cryptographically safe offline password generator that produces readable or dense random strings, measures entropy in bits, and includes quick copy and a scratch notepad.

Concise instructions

This password generator is secure because it relies on your browser's built‑in private randomness system. It does not connect to any server or share data: everything happens locally on your device. The randomness source ensures that each character is equally likely, so the results are unpredictable and private.

Set Length of the password and Quantity of passwords to generate.

Choose a style:

• Charsets: lowercase / UPPERCASE / digits / symbols, or
• Readable alphabets: Base32 (Crockford) or Base58 (Bitcoin), or
• Intercalate vowels and hyphens (IV) for pronounceable patterns.

Optionally enable Avoid ambiguous to exclude look‑alike characters. (This cannot be combined with Base32, Base58, or IV.)

Press Generate.

Use Copy for results, or draft in Notepad and Copy notepad.

Aim for ≥ 80 bits for routine logins; 100–128 bits for long‑term or high‑value secrets.

Detailed instructions

1) What this tool does — in one paragraph

It creates uniformly random passwords using a selected alphabet and a specified length. In flat mode, every character is drawn from the same alphabet. In IV (Intercalate Vowels and hyphens) mode, characters alternate between your full alphabet and a vowel+hyphen set to improve readability. For IV, strength is computed conservatively by averaging the information contributed by each alternating set.

2) Controls & options — complete reference

Below is every control in the UI, grouped by purpose and with interaction rules.

Basics

Length — Number of characters per password.

Quantity — How many passwords to generate at once.

Character sources

Charsets — Toggle any of the following to build your alphabet:

• lowercase — a–z.
• UPPERCASE — A–Z.
• Digits — 0–9.
• Symbols — curated punctuation set chosen for broad keyboard availability.

Readable alphabets — One-click presets designed for transcription:

• Base32 (Crockford) — 32-symbol set removing confusables (e.g., I, L, O, U).
• Base58 (Bitcoin) — 58-symbol set excluding 0/O and I/l for compact, human-friendly codes.
• IV (Intercalate vowels and hyphens) — Alternates your full alphabet with a vowel+hyphen set for pronounceable patterns (hyphen acts as a visual separator).

Avoid ambiguous — Removes look‑alike symbols (O/0, I/1/l, S/5, B/8, Z/2, G/6, U/V, u/v, W/w, etc.).

Actions and displays

Generate — Produces the requested number of passwords using the current settings.

Copy — Copies the generated passwords.

Notepad — Scratch area for drafting or comparing ideas.

Copy notepad — Copies the notepad contents.

Entropy bits (per password) — Strength estimate for one password under the current settings.

Random source — Indicates Crypto (secure) or Math.random (fallback, not secure). A warning banner appears when crypto is unavailable.

Debug log (optional) — Shows internal checks and test notes; for diagnostics of software errors only. Not meant to be used by the final user.

Defaults

Starts with lowercase + IV enabled; length auto-adjusted on first load to roughly meet an 80‑bit target under IV.

3) How generation works (methodology)

Randomness source — Uses window.crypto.getRandomValues for cryptographic randomness when available.

Modulo-bias avoidance — Applies rejection sampling so each index in the alphabet range ([0, |A|−1]) is equally likely.

Fallback — If the crypto API is missing, the app uses Math.random and surfaces a warning; prefer a modern browser.

Mode specifics — Flat mode draws every character from one alphabet; IV mode alternates between the full alphabet and the vowel+hyphen set, with the starting set chosen uniformly at random.

4) How strength is measured (entropy)

Definition — Entropy is measured in bits and approximates the size of the search space.

Flat mode — H = L × log₂|A|, where L is length and |A| is alphabet size.

IV mode (conservative) — H ≈ L × (log₂|A_all| + log₂|A_vowel|) / 2, averaging the information of the two alternating sets.

Per item — The meter reports entropy per password; generating more lines does not change the strength of each line.

5) Length guidance & targets

Recommended targets

Routine accounts: ≥ 80 bits.

Long‑lived / administrative / high‑value secrets: 100–128 bits.

Below ~60 bits is discouraged today.

Typical lengths to reach targets

*IV default uses lowercase for the full set and vowels+hyphen for readability; effective information is ≈ 3.64 bits/char, so lengths are longer for the same target.

6) Recommended workflows

Generate several candidates; Copy the one you will use.

Use Notepad to compare formats or compose a passphrase; then move it to your password manager.

For stressful manual entry (mobile, low light), prefer Base32, Base58 or IV for fewer transcription errors, and increase Length to keep your entropy target.

7) Security notes

Estimates assume uniform draws and no side channels.

Readability options reduce the alphabet size; increase length to compensate.

The app prefers cryptographic randomness and eliminates modulo bias via rejection sampling.

Performance caution — Generating extremely long passwords (thousands of characters) or very large quantities (hundreds or thousands at once) can consume significant memory and CPU in the browser. On some devices this may cause noticeable lag or even make the page unresponsive. If you experience performance issues, keep lengths and counts within reasonable ranges (tens to low hundreds), and generate in smaller batches if you need more.

Glossary

Alphabet (A) — The set of possible symbols a password may use. Its size |A| determines the per‑character information. For example, lowercase a–z gives |A|=26, while adding digits expands it to 36.

Entropy (H) — A measure of unpredictability expressed in bits. In flat mode, H = L × log₂|A|, where L is the password length. Each extra bit doubles the effort required for brute force.

Rejection sampling — A technique used to ensure fairness when converting random numbers into characters. A random number generator produces values in a large range (for example 0–2³²−1). If this range does not divide evenly by the alphabet size |A|, some remainders would occur more often if one simply took x % |A|. Rejection sampling discards any value that would create bias (i.e. those beyond the largest multiple of |A|), and retries until a valid value is drawn. This guarantees every character in the alphabet has exactly equal probability.

Modulo bias — A distortion introduced when mapping random numbers to an alphabet using x % n, if the generator's range is not evenly divisible by n (the alphabet size). For example, if the random source gives values 0–255 and the alphabet has 10 characters, the values 250–255 will unfairly favor the lower remainders. As a result, some characters appear more often than others, reducing true randomness. This matters because attackers can exploit even small biases if billions of guesses are made. To eliminate this, rejection sampling discards the unfair excess and redraws until a balanced value is found, ensuring each character is exactly equally probable.

Base32 (Crockford) — A human‑friendly 32‑symbol alphabet (0–9, A–Z but omitting I, L, O, and U). Designed by Douglas Crockford, it specifically addresses the problem of transcription errors: characters that are often confused are removed, and some substitutions (such as treating O and 0 as equivalent) are explicitly allowed. This makes it robust for manual use, printed media, and contexts such as QR codes, license keys, and identifiers where human error is likely. Its lower symbol count means longer strings are needed for the same entropy compared to Base58, but the trade‑off is maximum clarity.

Base58 (Bitcoin) — A 58‑symbol alphabet most famously used in Bitcoin addresses. It excludes all visually confusable characters (0, O, I, l, etc.), providing compact yet human‑readable codes. Base58 achieves higher entropy per character than Base32, so strings can be shorter for equivalent strength. It is particularly useful when copying/pasting between programs, encoding wallet addresses, or displaying codes where both machine efficiency and human readability matter. The design goal was to reduce mistakes in financial contexts where errors are costly and irreversible.

IV (Intercalate vowels and hyphens) — A mode where the generator alternates between the full chosen alphabet and a smaller set of vowels plus hyphen. This creates outputs that are easier to read, pronounce, or transcribe. The hyphen also improves visual segmentation. Entropy per character is lower, so longer lengths are recommended.

Ambiguous characters — Characters that are visually similar (e.g., O/0, I/1/l, S/5, B/8). Excluding them reduces transcription errors in contexts like manual typing, system administration, or printed labels, at the cost of a smaller alphabet and slightly lower entropy per character.