Secure Password & Secret Generator

Math.random() is not designed to be unpredictable — in many JavaScript engines its internal state can be reconstructed from a handful of outputs, which makes it unsuitable for anything security-sensitive. crypto.getRandomValues() is backed by the operating system's cryptographically secure random number generator, which this tool uses exclusively.

It's log2(number of possible values) — for a password, log2(character set size) per character; for a passphrase, log2(word list size) per word. Higher means an attacker who knows exactly how the secret was generated (but not the secret itself) would need to try more combinations on average to guess it.

With a 578-word list, six words give roughly 55 bits of entropy, which is comparable to a randomly generated password of similar strength while being easier to remember and type. For high-value secrets, prefer more words or a longer random password/token instead.

No. Everything is generated and displayed locally in your browser. Nothing is sent to a server, added to the URL, written to local storage, or logged.

No — bcrypt requires a dedicated JS/WASM library that isn't part of the Web Crypto API, and it's out of scope for this release. This page only generates secure random secrets; see the Hash & Checksum and HMAC tools for hashing and message authentication.