Password Generator - حاسبة مجانية على الإنترنت

Weak passwords are still the single largest cause of account breaches. Billions of credentials leak each year through data breaches, phishing campaigns and stuffing attacks; the longer and more random your password, the safer your account. A 6-character lowercase password can be brute-forced in seconds on modern hardware; a 16-character mixed-case-numeric-symbol password is effectively unbreakable for the next several decades. This generator uses your browser's cryptographically-secure random number API (the same one banks use for session keys) to produce passwords that are genuinely unpredictable, not the pseudo-random sequences that programming languages return by default.

Why generate rather than think one up? Humans are notoriously bad at picking 'random' anything. We unconsciously avoid certain letters, repeat patterns, base passwords on dates and names, and reuse the same root across accounts. A generator removes all that bias. Pair this tool with a password manager (Bitwarden, 1Password, Apple Keychain, Google Password Manager) and you get the gold standard: a unique 20+ character random password per account, with you only needing to remember one master password.

The generator uses window.crypto.getRandomValues() - a Web Crypto API that returns cryptographically-strong random numbers backed by the operating system's entropy source. This is the same quality of randomness used for TLS session keys and cryptographic operations. JavaScript's regular Math.random() is NOT cryptographically secure and is never used here.

To ensure all enabled character classes appear (some sites require at least one uppercase, one number, etc.), the generator first picks one random character from each enabled set, then fills remaining positions from the combined pool, then shuffles the entire string with Fisher-Yates shuffle (also cryptographically random). This guarantees policy compliance while remaining unpredictable.

Entropy - the strength measure shown - is computed as length × log₂(pool size). Each random bit of entropy doubles the brute-force cost. 60 bits is the minimum for serious accounts; 80+ is recommended for banking and email; 128+ is overkill for nearly any practical purpose. A 16-character password from a 94-character pool has ~105 bits of entropy - beyond reach of any current or projected brute-force attack.