How it works
The generator draws from the selected character sets using the browser crypto random source, then reports the estimated entropy as length × log2(alphabet size). Characters are chosen independently, without dictionary words or keyboard patterns.
- Passwords are generated in the tab and never stored. Nothing is sent over the network.
Why it matters
Credential stuffing works because people reuse patterns. A generated password of sufficient length is the cheapest defence available, and knowing the entropy figure helps decide whether 16 characters are enough for a given account.
A worked example
A 20-character password from a 94-character set carries about 131 bits of entropy. A 12-character password with "P@ssw0rd"-style substitutions is far weaker than its length suggests.
Common mistakes
- Reusing one strong password across sites.
- Relying on l33t substitutions instead of length.
- Storing generated passwords in a plain text file.
Practical tips
Store generated passwords in a password manager so length is free rather than memorable. Keep passphrases for the master password and generated strings for everything else; enable two-factor authentication where it exists.
How to use it
- Open the tool. Everything runs in your browser tab.
- Paste or type your input, then choose the action you need.
- Check the result and copy it with one click.
Common questions
Are generated passwords safe to use?
They are created with the browser crypto generator. Store them in a password manager rather than memorising or reusing them.
How much entropy does a password have?
The page estimates bits of entropy from length and character sets. Longer passwords add more entropy than extra symbols.
Are the passwords stored or sent?
No. Generation happens in the tab and nothing is stored or transmitted.
Is this tool really free?
Yes. There is no account, no paywall and no usage limit. Tools App is funded by aumenso, the studio behind it.
Is anything I enter uploaded?
No. The tool runs in your browser tab; what you enter is never sent to us and never stored.