How long should a password be?

At least 16 characters for anything stored in a password manager, and 12 as an absolute floor for accounts you type into. Length is the parameter with the largest effect on offline cracking cost.

Are generated passwords sent to a server or logged?

No. Generation uses the browser's Web Crypto API locally; the value exists only in the page until you copy it. Reloading the page discards it permanently.

Is a random password better than a passphrase?

Per character, yes; per unit of human effort, often no. A 20-character random string beats a four-word passphrase on entropy, but a six-word passphrase is both strong and memorable. Choose by whether a human has to type it.

Do password expiry policies help?

Current NIST guidance (SP 800-63B) recommends against routine forced rotation, because it drives predictable increments such as Summer2025! Rotate on evidence of compromise instead.

Security🔒 Browser (client-side)API available📴 Works offlinebeginner

Password Generator

Generates cryptographically strong random passwords.

Data stays in your browser

Ready to runInstant execution

All tools →

Length

Result

—

What does this tool do?

Generates cryptographically strong random passwords.

Why would I use it?

You need a new password for an account or service.
You want a strong default instead of a memorable-but-weak one.
You are provisioning credentials for a tool.

Real-life example

Input

Length 20, all character classes

Output

7$kQp2!vRz9@mXc4#Lw5

Generated with the browser's crypto API.

Input → Process → Output → Next

Input: Choose length and character classes.
Process: The browser generates random characters using crypto.getRandomValues.
Output: A random password with estimated entropy.
Next action: Store it in a password manager — do not reuse it.

Common mistakes

Reusing passwords across sites.
Using fewer than 12 characters.
Storing passwords in plain text files or emails.

What the result means

Entropy estimates how many guesses an attacker needs; more is better.

Privacy & security

Your input is processed entirely in your browser and never sent to a YAS server.

API

Endpoint

POST https://yas.sh/api/v1/tools/password-generator

Request Header

Content-Type: application/json

cURL

curl -X POST "https://yas.sh/api/v1/tools/password-generator" \
  -H "Content-Type: application/json" \
  -d '{"length":24,"count":1}'

JavaScript

const res = await fetch("https://yas.sh/api/v1/tools/password-generator", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "length": 24,
  "count": 1
}),
});
const data = await res.json();

Python

import requests

r = requests.post("https://yas.sh/api/v1/tools/password-generator", json={"length":24,"count":1})
data = r.json()

Field	Type	Required	Description
length	integer	No (default 20)	8–128
count	integer	No (default 1)	1–10 passwords
mode	"full" \| "alnum"	No (default "full")	Charset (full includes symbols, unambiguous alnum)

Success response

{ "slug": "password-generator", "length": 24, "result": "<password>" }

CSPRNG passwords, 8–128 chars, optional alnum-only sets.

Error responses

400 VALIDATION_ERROR — invalid input or unsupported option.
413 PAYLOAD_TOO_LARGE — input exceeds the 64 KB limit.
429 RATE_LIMIT_EXCEEDED — rate limit exceeded (60 req/min).

Limits

Maximum input: 64 KB per request.
Rate limit: 60 requests/min per IP address.
Authenticated accounts benefit from higher tier quotas.

How Password Generator works

Randomness comes from crypto.getRandomValues(), the browser's cryptographically secure pseudorandom number generator, which is seeded from the operating system entropy pool. Math.random() is never used: it is a fast non-cryptographic PRNG whose internal state can be recovered from a handful of outputs, which would make every generated password predictable.

Characters are drawn from the selected alphabet using rejection sampling rather than a modulo reduction. Taking a random byte modulo an alphabet size that does not divide 256 makes the first few characters of the alphabet slightly more likely; rejecting out-of-range values and drawing again keeps the distribution uniform, which is what the entropy calculation assumes.

Strength is measured in bits of entropy: length × log2(alphabet size). A 16-character password from the 94 printable ASCII characters is about 105 bits. Entropy describes the generator, not the string — 'aaaaaaaa' drawn from a 94-character alphabet still carries the same entropy as any other 8-character draw, because the attacker cannot know which one you got.

When to use it: real-world scenarios

Creating a credential you will store in a password manager

Maximise length and alphabet; you never type it. Twenty or more characters with all classes enabled puts an offline attack far beyond feasibility even against fast hashes.

Generating a service account or database password

Machine credentials should be long and rotated. Disable ambiguous characters if the value passes through shell scripts, connection strings or YAML, where quoting mistakes cause outages more often than weak passwords cause breaches.

Producing a password a human must type on a TV or console

Use the Passphrase Generator instead. Four or five random words carry 50–65 bits of entropy and can be entered on a D-pad without transcription errors.

Meeting a legacy complexity policy

Some systems demand at least one character from each class and cap the length. Enable the classes, set the maximum allowed length, and accept that the policy — not the generator — is the limiting factor.

Pro tips

Length beats symbol soup. Adding four characters to a lowercase-plus-digits password buys more entropy than sprinkling punctuation into a short one.
Never reuse a generated password across services. The dominant real-world attack is credential stuffing from someone else's breach, which strength alone does not mitigate.
Turn off symbols for values that end up in URLs, shell commands or connection strings unless you are certain about quoting; '$', '!' and backtick each have their own way of ruining a deployment.
Enable two-factor authentication wherever it is offered. A 100-bit password does not protect an account against phishing or session-token theft.

Limitations and edge cases

What this tool deliberately does not do, and where it will disagree with other implementations.

Generation happens in your browser and nothing is stored, which also means a password lost before you save it is unrecoverable.
Entropy figures assume the generator is uniform and the attacker knows your settings. They say nothing about how the password is stored on the other end — a site that hashes with unsalted MD5 undermines any password you give it.
Excluding ambiguous characters (0/O, 1/l/I) reduces the alphabet and therefore the entropy slightly; the tool reports the adjusted figure rather than the ideal one.
Browser extensions with permission to read page content could observe generated values. For the highest-value secrets, generate offline in a password manager.

Frequently asked questions

How long should a password be?: At least 16 characters for anything stored in a password manager, and 12 as an absolute floor for accounts you type into. Length is the parameter with the largest effect on offline cracking cost.
Are generated passwords sent to a server or logged?: No. Generation uses the browser's Web Crypto API locally; the value exists only in the page until you copy it. Reloading the page discards it permanently.
Is a random password better than a passphrase?: Per character, yes; per unit of human effort, often no. A 20-character random string beats a four-word passphrase on entropy, but a six-word passphrase is both strong and memorable. Choose by whether a human has to type it.
Do password expiry policies help?: Current NIST guidance (SP 800-63B) recommends against routine forced rotation, because it drives predictable increments such as Summer2025! Rotate on evidence of compromise instead.

Related tools

Passphrase Generator Password Strength