パスワード自動生成

このツールについて

A strong password is long, random, and drawn from a large character set — properties that make it resistant to both guessing and brute-force attacks. Reused or predictable passwords (dictionary words, birthdates, keyboard patterns) are the leading cause of account takeovers, since a single leaked password is often tried across many other sites (credential stuffing). This tool generates cryptographically random passwords using the Web Crypto API, with adjustable length and character sets, an option to exclude visually ambiguous characters, and a strength meter with an estimated offline crack time — all computed locally in your browser.

使い方

1. 1Drag the Length slider to choose how many characters the password should have (4–64).
2. 2Check or uncheck Uppercase, Lowercase, Numbers, and Symbols to control which character types are included.
3. 3Enable "Exclude ambiguous characters" if the password will be typed by hand, to avoid confusing 0/O or l/1/I.
4. 4Click "Regenerate" for a new password with the same settings, or click the copy icon to copy the current one.

よくある質問 (FAQ)

How is the password generated — is it truly random?

Yes. This tool uses the Web Crypto API's crypto.getRandomValues(), a cryptographically secure random number generator, with rejection sampling to avoid modulo bias. This is a different, much stronger source of randomness than Math.random(), which is not safe for generating passwords or keys.

What does the strength meter and "time to crack" mean?

The meter is based on the password's entropy (bits of randomness), calculated from its length and character set size. The crack-time estimate assumes an offline attacker guessing at 10 billion attempts per second — a reasonable modern GPU-based estimate — and shows roughly how long it would take to guess the password on average.

Should I exclude ambiguous characters?

Only if you need to type or read the password manually — excluding 0/O and 1/l/I avoids misreading it. If the password will only ever be copy-pasted (e.g. stored in a password manager), leave this off to keep the full character set and maximum entropy.

Is my generated password sent anywhere?

No. Generation happens entirely in your browser using the Web Crypto API — the password is never transmitted to a server or stored anywhere. Closing or refreshing the page discards it, so save it in a password manager right away.