Password Generator
Generate strong passwords with configurable rules.
Passwords are generated locally via crypto.getRandomValues — nothing is sent to the server.
About this tool
A strong password is the cheapest security control you can apply. This generator builds random passwords entirely in your browser using crypto.getRandomValues() — the cryptographically-secure RNG that browsers expose for exactly this purpose. Set the length (8 to 64), pick which character classes to include (uppercase, lowercase, digits, symbols), exclude ambiguous characters (0/O, 1/l/I) if you will be reading them aloud, and generate as many candidates as you like.
Alongside random passwords we offer two variants: passphrases (4–8 dictionary words joined by a separator — the famous "correcthorsebatterystaple" style) and PINs (digits only, 4–10 characters, useful for device unlock codes). Each generated value comes with a strength estimate based on Shannon entropy: 60+ bits is comfortable for most accounts, 80+ bits is paranoid-grade. Nothing leaves your device — there is no network call, no logging, no server-side generation step.
When to use this tool
- Account creation. Generate a unique 20-character password per service, store it in a password manager.
- API tokens and secrets. Quickly produce high-entropy strings for
.envfiles, signing keys, and admin credentials. - Wi-Fi network keys. A 16-character WPA2 PSK with mixed classes is solid; longer is better and easy to set once.
- Memorable passwords for rare-use accounts. Use the passphrase mode for the handful of passwords you actually have to type by hand.
What "strength" means
Strength is reported in bits of entropy — log2(possible-passwords-of-this-shape). A 12-character password drawn uniformly from 94 printable ASCII characters has 12 × log2(94) ≈ 79 bits. At current cracking speeds (~10^12 hashes/sec for unsalted SHA-256), 80 bits resists every offline attack for the lifetime of the universe. The weak link is almost never password length above 60 bits — it is reuse, phishing, and breach databases. Combine a strong generator with a password manager and 2FA.Frequently asked questions
Is the randomness actually random?
window.crypto.getRandomValues(), which is backed by the operating system's CSPRNG (e.g. /dev/urandom on Linux, CryptGenRandom on Windows). This is the same source TLS uses to generate session keys; it is cryptographically secure and indistinguishable from true randomness for all practical purposes. Earlier methods like Math.random() are NOT used here — those are deterministic and not suitable for security.
How long should my password be?
What does "exclude ambiguous characters" do?
0/O/o, 1/l/I, sometimes 2/Z. The trade-off is a small entropy drop (~3% per excluded character), in exchange for much fewer "typed it wrong" frustrations when the password is read off paper or a screen. Recommended for printed Wi-Fi keys and one-time setup tokens; unnecessary for password-manager-only entries.