Tools
Password generator
Generate strong, random passwords right in your browser. Set the length from 8 to 128 characters, choose which character sets to include, optionally exclude ambiguous glyphs, and watch a live entropy estimate rate the result. Bulk-generate up to 50 at once and copy them individually or all together. Every password is produced with the Web Crypto API (never Math.random), and nothing ever leaves your machine.
Generated in your browser with the Web Crypto API (crypto.getRandomValues), never Math.random. Nothing is sent to a server: no network requests, no logging, no storage.
Choose your options and press Generate to create passwords.
What makes a password strong?
Strength comes from unpredictability, not clever substitutions. A truly random password has no pattern for an attacker to exploit, so its resistance to guessing is captured by a single number: entropy, measured in bits. The more bits, the more equally-likely possibilities an attacker must work through.
Entropy is length × log2(alphabet size). Two levers raise it: making the password longer, and enabling more character sets to widen the alphabet. A 20-character password drawing on lowercase, uppercase, digits, and symbols pulls from a 90-plus character alphabet, which lands solidly in the strong range. Excluding ambiguous characters trims the alphabet slightly for readability, and the entropy readout updates so you always see the trade-off.
Why crypto.getRandomValues, not Math.random?
Math.random is a fast pseudo-random generator built for simulations and animations, not secrets. Its internal state can be recovered from a handful of outputs, which means passwords built on it are predictable. This tool uses crypto.getRandomValues, a cryptographically secure source, and applies rejection sampling so no character is even slightly more likely than another. That is the difference between a password that looks random and one that is.
Frequently asked questions
- Are these passwords safe to use?
- Yes. Every character is drawn from the Web Crypto API (crypto.getRandomValues), a cryptographically secure random source built into your browser. This tool never uses Math.random, which is predictable and unsuitable for secrets. Rejection sampling is used so each character is uniformly likely, avoiding modulo bias.
- What does the entropy estimate mean?
- Entropy is measured in bits and equals the password length multiplied by log2 of the alphabet size (the number of character sets you enable). It scores the strength of the random generation process, not a single output string. As a rough guide: under 50 bits is weak, 50 to 74 is fair, 75 to 109 is strong, and 110+ is excellent.
- Why would I exclude ambiguous characters?
- The characters O, 0, l, 1, and I are easy to confuse when a password is read aloud, printed, or typed by hand. Excluding them makes a password less error-prone to transcribe. It slightly shrinks the alphabet, so the entropy readout updates to reflect the smaller character set.
- How long should my password be?
- Longer is stronger. For most accounts, 16 to 20 characters with several character sets enabled comfortably reaches the strong-to-excellent range. Use even longer values for high-value credentials or anything protecting other secrets. This tool supports up to 128 characters.
- Do these passwords get sent anywhere?
- No. Generation happens entirely in your browser. There are no network requests, no analytics on the values, and nothing is written to a server or to storage. Once the page has loaded you can even generate passwords offline.