How to generate a strong password
Set the length with the slider, choose which character sets to include — uppercase, lowercase, digits and symbols — and press Generate. The result appears instantly in the output box, ready to copy or download. Need several at once? Set Count to 5, 10 or 25 and the tool produces a batch, one password per line, which is handy when you are provisioning multiple service accounts or seeding a password manager. Every character is drawn from the browser's cryptographic random source the moment you click, so no two results are ever the same and nothing is precomputed on a server.
The No look-alikes option removes easily-confused characters such as capital I, lowercase l, the digit 1, capital O and the digit 0. That makes a password far easier to read off a screen or dictate over the phone without a costly transcription mistake, at the cost of a slightly smaller alphabet — a trade-off the entropy meter shows you in real time.
What the entropy meter actually measures
Password strength is best expressed in bits of entropy, not vague labels like "medium." Entropy is calculated as length × log2(alphabet size): every extra character multiplies the number of possible passwords, and a bigger character pool raises the per-character contribution. A 20-character password drawn from the full 94-character printable-ASCII set carries roughly 131 bits of entropy — more than enough that brute force is computationally hopeless even for a state-level attacker. The meter on this page recomputes that figure live as you change the length or toggle character sets, so you can see exactly how each choice affects strength.
As a rough guide: under 40 bits is weak and crackable, 60–80 bits is reasonable for everyday accounts, and 100 bits or more is strong enough for master passwords and encryption keys. Because entropy grows linearly with length but only logarithmically with alphabet size, adding characters beats adding symbol types almost every time — a lesson the meter makes obvious.
So how long should a password be?
For ordinary website logins, aim for at least 16 characters with a mix of types. For anything high-value — your email account, your bank, and above all the master password that unlocks a password manager — use 20 or more. Length is the single most important dial: a long passphrase of common words can be both stronger and more memorable than a short tangle of symbols. The reason to still prefer a random generated string for most accounts is simple: you should never reuse a password, and a manager will remember the random ones for you so their unmemorability stops being a problem.
Why generating passwords locally is safer
A password is a secret, and the cardinal rule of secrets is that they should travel as little as possible. Many online "password generator" pages produce the value on their server and send it back to your browser, which means your brand-new secret has already crossed the network and may sit in a log, a load balancer, or an analytics pipeline before you ever see it. Pasting requirements into an AI chatbot and asking it to "make me a password" is worse still: the output is not cryptographically random, and the request may be retained or used for training.
gitime.dev takes the opposite approach. This generator uses crypto.getRandomValues, the browser's built-in cryptographically secure random number generator, to pick each character with rejection sampling so there is no modulo bias toward any part of the alphabet. The whole operation happens inside your tab — there is no request to generate, no logging of output, and no account. Close the tab and every generated value is gone. That is what makes it safe to create the password for a real, live account here rather than on a server you do not control.
- CSPRNG randomness via
crypto.getRandomValues— neverMath.random. - Unbiased character selection through rejection sampling.
- Live entropy in bits so strength is measured, not guessed.
- Bulk mode for provisioning many accounts at once.
- Nothing is uploaded, logged or stored — it all stays on your device.
Password hygiene that actually matters
A strong generator is only one piece. Use a unique password for every account so a breach of one service cannot unlock the others, and store them in a reputable password manager rather than a notes file or a spreadsheet. Turn on two-factor authentication wherever it is offered — a strong password plus a second factor is dramatically harder to defeat than either alone. Finally, change a password promptly if a service you use discloses a breach, and never reuse the old one. None of these habits require you to memorize anything beyond a single strong master password.
Frequently asked questions
- Are these passwords generated on a server?
- No. Everything runs as JavaScript in your browser via
crypto.getRandomValues. Nothing is sent over the network or logged, so it is safe for real credentials. - Is the randomness actually secure?
- Yes — it uses the browser's CSPRNG with rejection sampling to avoid modulo bias, not
Math.random. - How long should my password be?
- At least 16 characters for normal accounts; 20+ for email, banking and password-manager master passwords.
- What does excluding ambiguous characters do?
- It drops look-alikes like
Il1O0for easier reading and typing; the entropy meter accounts for the smaller alphabet.