Pwgen.net

Strong passwords, minted in your browser. Nothing leaves this page.

Fresh sheet

Click a note to copy it. when you're done.

Denominations

Every note carries its denomination: bits of entropy, the only honest measure of password strength. Times below assume an offline attacker testing 10¹² guesses per second against a fast hash — a slow hash like bcrypt or Argon2 stretches them millions of times longer.

Weak

under 50 bits

A 40-bit password falls in . Throwaway accounts only.

Fair

50 – 71 bits

64 bits holds for against a fast hash — decades against a slow one.

Strong

72 – 99 bits

80 bits takes . Beyond any realistic attack budget.

Fortress

100 bits and up

128 bits takes . Cryptographic-key territory.

Minted locally

Every password is generated by your browser with crypto.getRandomValues() — the same cryptographically secure randomness it uses for TLS. Characters are drawn with rejection sampling, so there is no modulo bias. This page makes no network requests, its Content-Security-Policy forbids them, and it works offline — save the file and carry it with you.

Nothing to trust

No server ever sees a password: there isn't one. Passwords are never stored, logged, or sent anywhere. Your settings persist in a browser cookie, written only after you change a setting — like any cookie it travels only with requests to the site hosting this page, and it never contains a password. The entire generator is this single file. View the source to audit it.