FIRST CHTools

FIRST CH TOOLS / Other / 37 PASSWORD GENERATOR

Secure Password Generator

Pick a length and the character types, and mint hard-to-guess passwords up to 50 at a time. Drop look-alike characters such as 0 and O, 1 and l, or trim the symbol set down to what your target system accepts. The randomness comes from this browser's cryptographic RNG; the passwords are never sent anywhere and never appear in the URL.

Length
Characters
—
Length
—
Characters available
—
Strength (entropy)
—
Verdict

Passwords
Why this strength
ItemValueWhat it means

Protecting a staging site with Basic auth? Paste the password into the htpasswd Generator to get the .htpasswd line (bcrypt / apr1) and the .htaccess snippet right away — also computed in your browser and never sent anywhere.

How to Use

  1. Choose a lengthIf you are unsure, start at 16 characters. Length buys more strength than extra character types do. For anything kept in a password manager, go 20 or longer; 12 to 16 is the practical range for something you have to type by hand.
  2. Pick the charactersIf the service rejects symbols, untick them; if it rejects only a few, delete those from "Symbols to use". Keep Drop look-alike characters on whenever the password will be written down, read out loud, or typed on another device.
  3. Generate and copyPress Generate and the list appears at once. Use the per-row Copy for a single password or Copy all for the whole batch. Check the strength in the bits above and in the "time to crack" rows below.

About This Tool

Every character comes from crypto.getRandomValues(), the browser's cryptographic RNG. Math.random() is never used: it is built for speed, and after observing a handful of outputs an attacker can recover its internal state and predict the rest. For a password, being unpredictable is the entire point, so that difference matters. Modulo bias is removed too. Taking a 32-bit random number modulo the pool size makes the first few characters of the pool slightly more likely, because 232 rarely divides evenly by the pool size; this tool throws away the values above the last whole multiple and draws again.

Strength depends on length far more than on variety. With N characters available and a length of L, there are NL combinations, which is L × log2(N) bits. Adding symbols lifts N from 62 to 94, but that is only 5.95 → 6.55 bits per character; adding one more character to the length adds a whole character's worth. Eight characters is about 52 bits even with symbols — hours to days once a leaked hash is attacked on GPUs. Twelve characters is about 79 bits and sixteen about 105, at which point brute force stops being a plan.

"At least one of each type" slightly lowers the strength. The rule throws away every candidate that happens to contain no uppercase letter, so there are fewer candidates left. This tool subtracts that loss using inclusion–exclusion and reports the reduced figure — most generators keep showing L × log2(N), which reads a little higher than the truth. The loss is small, from a fraction of a bit to a few bits, and the rule is simply the price of passing services that demand one of each. The guaranteed characters are then mixed in with a Fisher-Yates shuffle so they do not pile up at the front.

Only drop look-alike characters when the password will be transcribed. Dropping them shrinks the pool and costs a little strength at the same length (94 → 87 characters is 0.11 bits per character). If the password goes straight into a password manager by copy and paste, leave them in. But when an initial password is handed over on paper, read over the phone, or retyped on another machine, mixing up 0 with O, or 1 with l and I, costs more in support tickets than those fractions of a bit are worth.

The passwords never leave this device. They are not uploaded, and they are deliberately kept out of the URL as well — URLs survive in browser history, bookmarks and shared links, which makes them a poor place for a secret. Only settings can be passed in: /en/password/?length=24&count=3&symbols=0 (length=4–128, count=1–50, upper/lower/digits/symbols=0|1, similar=1 to drop look-alikes, each=1 to require one of each type, symbolset= the symbols to use, exclude= characters to leave out). There is intentionally no download button, because a plain-text file of passwords sitting in your Downloads folder is not something to encourage. Paste straight into a password manager, and use a short-lived secure channel if you have to share one.

Not reusing passwords matters more than making them stronger. However strong a password is, using it on several services means one breach unlocks the rest — that is credential stuffing. Use a different password per service, keep them in a manager, and add passkeys or two-factor authentication wherever they are offered. As for rotation, NIST SP 800-63B says not to force periodic changes without evidence of compromise, because mandated changes mostly produce predictable edits such as Pass1! → Pass2!.

Other Tools