Password Generator
Generate cryptographically secure passwords and passphrases with an entropy readout.
crypto.getRandomValues ile cihazınızda üretilir; hiçbir zaman sunucuya gönderilmez veya kaydedilmez.Entropi, bir saldırganın parolayı kaba kuvvetle bulmak için ortalama kaç deneme yapması gerektiğini ölçer. 60 bit çevrimiçi saldırılara karşı yeterlidir; çalınmış bir parola veritabanına karşı en az 75 bit, uzun ömürlü sırlar için 100 bit hedefleyin. Uzunluk, karakter çeşitliliğinden daha etkilidir: 20 karakterlik küçük harfli bir parola, 8 karakterlik karışık bir paroladan çok daha güçlüdür.
What is Password Generator?
The Password Generator produces passwords and passphrases from a cryptographically secure randomness source (crypto.getRandomValues) and reports the entropy of each configuration in bits.
Entropy measures how many attempts a brute-force attacker needs on average. 60 bits is fine against online attacks; target at least 75 against a stolen password database, and 100 for long-lived secrets.
Length beats character variety: a 20-character lowercase password is clearly stronger than an 8-character mixed one. Nothing generated here is transmitted or stored.
Frequently Asked Questions
9 questionsAre the passwords sent to a server?
No. They're generated in your browser with crypto.getRandomValues — the operating system's cryptographic randomness source. Nothing is transmitted or stored, and the values are gone when you close the page.
How much entropy is enough?
60 bits is fine against online attacks (login forms with rate limits). Target at least 75 bits against a stolen password database. For encryption keys and long-lived secrets, 100 bits and up.
Passphrase or password — which is safer?
At equal entropy they're equally safe; the difference is usability. Passphrases are easy to type and remember, which suits a master password or disk encryption. For anything stored in a password manager, a random character string is shorter.
Why exclude ambiguous characters?
If you'll read the password off a screen or printout and retype it, I/l/1 and O/0 confusion is a real problem. But the option shrinks the character pool and lowers entropy slightly — leave it off for anything going into a password manager.
Can I reuse this password in several places?
Don't. However strong it is, one breached service puts every account sharing it at risk. Generate a separate password per account and keep them in a password manager.
Should I use a password manager?
Yes. It's the only practical way to have a different long password per account. Pick your master password as a passphrase — easy to type and remember — and let the manager generate everything else.
How often should I change my password?
Scheduled rotation is no longer recommended — NIST has advised against it since 2017 because it pushes users into predictable patterns (Password1, Password2). Change on suspicion of exposure, and instead use a unique password everywhere plus two-factor authentication.
With 2FA enabled, does password length still matter?
Yes. A second factor is a layer, not a replacement: it can be defeated by SIM swapping, session theft and phishing. A strong password and 2FA work together.
Does the separator make a passphrase stronger?
Its entropy contribution is negligible; the strength comes from the word count and dictionary size. The separator is for readability and for systems that insist on mixed character types.