Password Generator
Create strong, random passwords right in your browser. No data sent to any server.
How the password generator works
A strong password is the first line of defense for your accounts. Its strength depends on two things: length and the variety of characters used. The longer a password is, and the more it draws on different character sets (lowercase, uppercase, digits and symbols), the harder it becomes to guess or brute-force with an automated attack. This tool generates fully random passwords according to the criteria you choose, right in your browser.
Randomness comes from the browser's Web Crypto API (crypto.getRandomValues), a cryptographic-quality source of random numbers — far safer than a plain Math.random(). To avoid statistical bias when picking characters, the tool uses a technique called rejection sampling, which ensures every character in the set has exactly the same probability of being chosen.
You can adjust the length, toggle individual character types on or off, and exclude ambiguous characters (like O and 0, or l and 1) for passwords that are easier to read and transcribe. The strength indicator estimates entropy in bits — how unpredictable the password is. Everything happens in your browser: no password is ever sent to or stored on a server.
The moment you most often need a password generator is when creating a new account or periodically changing an existing password: instead of inventing a predictable variation of a password you've already used elsewhere, generating a fresh random one removes any recognizable pattern. It's also useful for generating API keys, shared secrets for webhooks, or temporary tokens, where what matters is a robust random string rather than something "memorable".
A randomly generated password like these is meant to be saved in a password manager, not memorized — its randomness is exactly what makes it secure, but also impossible to reliably remember. If you instead need a password you can actually recall, a passphrase made of several random words (say, four or five words picked randomly from a dictionary) often offers a better trade-off between security and memorability. It's also worth remembering that password strength defends against brute-force or dictionary attacks, but not against other risks like phishing or reusing the same password across sites: using a different one for every service, via a password manager, remains the single most effective protection. Recent security guidelines (such as NIST SP 800-63B) advise against imposing rigid composition rules or mandatory periodic rotation without a concrete reason, recommending instead to favor length and to check passwords against known lists of breached credentials.
Frequently asked questions
- Are passwords generated on a server?
- No. Generation happens entirely in your browser via the Web Crypto API. No password is transmitted or stored — after the page first loads you can even use the tool offline.
- How long should a secure password be?
- As a rule of thumb, at least 12–16 characters with a mix of lowercase, uppercase, digits and symbols. Longer is better: length matters more for security than the complexity of individual characters.
- What does the strength indicator mean?
- It estimates the password's entropy in bits — how unpredictable it is. Roughly: below 40 bits is weak, above 80 bits is very strong. It's a theoretical estimate based on length and character-set size.
- Why exclude ambiguous characters?
- Characters like O and 0, or l (lowercase L) and 1, can be confused when a password is read or transcribed by hand. Excluding them makes the password more convenient, reducing the character space only slightly.