Password Generator

Generate strong passwords with the Web Crypto API. Choose the length, pick your character sets, and create up to 20 secure passwords at once.

Passwords are generated locally in your browser using the Web Crypto API. They never leave your device.

—
—

How We Generate Passwords

Every character of every password is drawn from your operating system's cryptographic random number generator through the Web Crypto API. The page never touches network, storage, or analytics — the passwords exist only in this tab's memory until you copy them somewhere safe.

crypto.getRandomValues()
The Web Crypto API's random function, backed by the OS CSPRNG (e.g. /dev/urandom or CryptGenRandom). Its output is cryptographically unpredictable — the right source for security-sensitive randomness.
Why not Math.random()?
Math.random() is a deterministic pseudorandom generator designed for UI effects and simulations. Given its output, an attacker can reverse its internal state and predict every future value. Never use it for passwords, tokens or keys.
Strength estimation
Estimated from length × character-set variety: fewer than ~38 bits of entropy is Weak, 38–67 bits is Medium, and 68+ bits is Strong. For reference, 16 random lowercase+uppercase+digit characters ≈ 93 bits, which is far beyond brute-force reach.

Frequently Asked Questions

Are these passwords truly random?

Yes. Every character is picked with crypto.getRandomValues(), which uses the operating system's cryptographic random number generator. Unlike Math.random(), its output is unpredictable and not affected by the page's other computations.

Do my passwords get stored or sent anywhere?

No. Passwords are generated in your browser's memory and exist only on this page. They are not written to storage, not logged, and never transmitted to any server.

How long should a password be?

Aim for at least 12 characters, ideally 16 or more. Length contributes more to security than character variety: a 16-character random password using only lowercase letters is stronger than a 10-character one using every symbol.

What does "exclude similar" do?

It removes the characters I, l, O and 0, which look almost identical in many fonts. The resulting passwords are slightly shorter in entropy, but much easier to read and type when you need to enter them by hand.

Can I generate more than 20 at once?

This tool caps the batch size at 20 to keep the output list manageable. For more, just click Generate again — every batch is a fresh, independent random draw.

Good passwords are only half the story: for something easier to remember, try the Passphrase Generator, and before storing any credential, sanity-check it with the Password Strength Checker.