Password Generator

Generate cryptographically secure passwords using your browser's built-in crypto API.

16
Click Generate to create a password
—
Count:

How to use

  • Drag the slider to set password length (8–64 characters).
  • Check the character sets you want to include in the password.
  • Enable Exclude ambiguous characters to avoid confusing look-alike characters.
  • Click Generate to create a new password, then copy it to the clipboard.
  • The strength meter shows estimated security based on entropy (bits of randomness).
  • Use Bulk Generate to create up to 100 passwords at once and copy them all.
  • All passwords are generated using crypto.getRandomValues() — never sent to any server.

Related Tools

UUID Generator QR Code Generator Color Picker JSON Formatter

About this Password Generator

Most hand-created "random" passwords lean on keyboard patterns or substitutions (@ for a) that crack faster than true randomness suggests. This tool generates entirely client-side, in your browser — the password never leaves your device or gets sent to any server — using crypto.getRandomValues(), the Web Crypto API's cryptographically secure random source, not JavaScript's ordinary Math.random(), which is not designed to be unpredictable enough for security use.

What the entropy number means

Entropy here is calculated as length × log₂(character set size) — for example, a 16-character password drawing from all four character sets (94 possible characters) has about 105 bits of entropy. That number is the count of random guesses (as a power of 2) an attacker with no other information would need to try every possibility. It measures the theoretical strength of the character selection, not how a specific password will hold up against a targeted or dictionary-based attack, which depends on far more than character-set math.

Limitations worth knowing

  • This generates random character strings, not multi-word passphrases (like "correct-horse-battery-staple") — if your target account prefers a long passphrase, this tool won't build one for you.
  • Each character is picked via value % charset.length against a 32-bit random number. Because most character-set sizes don't divide 232 evenly, this introduces an exceedingly small statistical bias toward earlier characters in the set — far too small to matter for generating a single password, but worth knowing if you were relying on this for a cryptographic use beyond password generation.
  • A generated password's real-world security also depends on how it's stored and used afterward — this tool can't protect a password that's reused elsewhere, written down insecurely, or transmitted over an unencrypted connection.

When to use which settings

For most accounts, 16+ characters with all four character sets enabled lands comfortably in "Very Strong" territory. Turn on Exclude ambiguous characters when you'll be reading the password aloud or typing it from a printout, since 0/O and l/1/I are easy to misread in some fonts. Use Bulk Generate when provisioning multiple new accounts or test users at once, so each gets an independently generated password rather than a reused one.