🔑 Password Generator

The generator uses Python's secrets module, which provides cryptographically strong random numbers sourced directly from the operating system's entropy pool — typically /dev/urandom on Linux systems. Unlike the standard random module which uses a predictable pseudo-random number generator, secrets is specifically designed for generating passwords, tokens, and authentication keys where unpredictability is critical. The tool builds a character pool from whichever categories you select — uppercase letters (A-Z), lowercase letters (a-z), digits (0-9), and symbols (!@#$%^&*) — then uses secrets.choice() to uniformly sample one character at a time for each position in the password. This ensures every character has an equal probability of being selected regardless of position, eliminating the statistical bias that pseudo-random generators would introduce when mapping random integers to character pools of non-power-of-two sizes.

Password strength is primarily determined by length and entropy per character. Entropy measures the randomness — a password drawn from four character classes (uppercase, lowercase, digits, symbols) has approximately 6.4 bits of entropy per character. An 8-character password from all four classes has roughly 51 bits of entropy, which is crackable in hours with modern hardware. A 16-character password from the same pool has approximately 105 bits of entropy, making brute-force attacks computationally infeasible with current technology. Each additional character multiplies the search space exponentially — going from 16 to 20 characters increases the difficulty by a factor of roughly 4,000. The secrets module ensures that the random sampling is backed by the same cryptographic entropy source used to generate TLS certificates, encryption keys, and other security-critical values on the system.

Common Use Cases

Generating strong passwords is essential for new account registrations where services do not provide their own password creation flow. API keys and access tokens for cloud services, databases, and third-party integrations require cryptographically random strings to prevent unauthorized access. Recovery codes and backup passwords, which serve as a safety net when primary authentication fails, must also be generated with high entropy. Session tokens and cryptographic nonces used in authentication protocols rely on the same type of random generation. This tool is particularly useful when you need passwords that comply with specific complexity requirements — for example, some systems require at least one uppercase letter, one digit, and one symbol. By selecting the appropriate character categories, you can generate passwords that meet exactly those requirements while maintaining maximum entropy for the given constraints.

Security & Privacy Considerations

Generated passwords are created in server memory, returned to the browser via the HTMX response, and never stored, logged, or persisted on the server in any form. The secrets module uses the operating system's Cryptographically Secure Pseudo-Random Number Generator (CSPRNG), which is the same entropy source used for generating TLS certificates, SSH keys, and disk encryption keys. After generation, the password exists only in your browser session and server memory — it is never written to disk or retained in any database. However, once you receive a generated password, you should store it in a reputable password manager immediately. Never save generated passwords in plain text files, browser autocomplete without a master password, sticky notes, or any unencrypted storage. For cryptocurrency wallet seeds, use the BIP-39 standard word list instead — this tool generates random characters, not the mnemonic phrases required by wallet recovery standards.

Frequently Asked Questions