About Password Generator
Passwords are generated in your browser with the Web Crypto random number generator, the same source browsers use for encryption keys. Nothing is sent to GlobTool or stored.
Each character is picked uniformly from the set you choose, without the bias simple generators introduce, and the strength is shown in bits of entropy.
How strong is strong enough?
| Entropy | Rating | Example |
|---|---|---|
| Under 50 bits | Weak | 8 lowercase letters |
| 50–79 bits | Fair | 12 letters and digits |
| 80–127 bits | Strong | 16 characters, all types |
| 128 bits and more | Very strong | 20 characters, all types |
How it works
Random numbers come from crypto.getRandomValues, the browser’s cryptographic generator. Values that would make some characters more likely than others are thrown away and drawn again (rejection sampling), so every character in the set is equally likely.
Entropy is the length multiplied by log2 of the number of characters in the set. When several character types are selected, each password is redrawn until it contains at least one of each.
How to use it
- 1Set the length
- 2Choose the character types
- 3Copy the password into your password manager
Questions
How long should a password be?
At least 16 random characters for accounts that matter. Length adds more strength than symbols.
What does “bits of entropy” mean?
How many guesses an attacker would need, as a power of two. 80 bits means about 2^80 guesses, far beyond any brute-force attack.
Why exclude look-alike characters?
Characters such as l, 1, I, O and 0 are easy to confuse when you have to read or type a password by hand.
Is the password sent anywhere?
No. It is generated and shown in your browser only.