About Password Generator
Password Generator creates random passwords entirely in your browser, using the Web Crypto API's cryptographically secure random number generator — not Math.random(), which is predictable and unsuitable for anything security-sensitive. You control the length and which character types are included; the tool computes an entropy estimate for the resulting password so you can judge how resistant it is to guessing. Nothing generated here is ever sent over the network, logged, or stored — closing or refreshing the page discards it completely, so save it somewhere safe (ideally a password manager) as soon as you generate it.
How to use it
- 1
Choose a length
Drag the length slider to pick how many characters the password should have (6-64).
- 2
Pick character types
Toggle uppercase, lowercase, numbers, and symbols on or off, and optionally exclude ambiguous characters like l, 1, I, O, and 0.
- 3
Copy it
A password regenerates automatically whenever you change an option. Click Copy to copy it to your clipboard.
What it does
- Generates random passwords using crypto.getRandomValues(), the browser's cryptographically secure RNG
- Uses rejection sampling to pick characters uniformly, avoiding the bias a naive modulo would introduce
- Lets you toggle uppercase, lowercase, numbers, and symbols independently
- Can exclude visually ambiguous characters (l, 1, I, O, 0) for passwords you'll need to type by hand
- Estimates entropy in bits based on the selected character set and length
FAQ
Is this password actually random, or just Math.random()?
It uses crypto.getRandomValues(), the Web Crypto API's cryptographically secure random number generator, not Math.random() — Math.random() is a fast, predictable PRNG that's unsuitable for anything security-sensitive since its output can sometimes be reconstructed. Character selection also uses rejection sampling rather than a plain modulo, so every character in the chosen set has an equal chance of appearing.
How long should my password be?
Longer is almost always better than more complex — a 16+ character password with just letters and numbers is generally stronger than an 8-character password with every symbol type. As a rule of thumb, aim for at least 60 bits of entropy (shown here as the 'Strong' rating) for everyday accounts, and 90+ ('Very strong') for anything protecting sensitive data.
Why exclude ambiguous characters?
Characters like lowercase l, uppercase I, and the number 1, or uppercase O and the number 0, look nearly identical in many fonts. If you'll ever need to type the password manually (rather than paste it from a manager), excluding them avoids typos — at a small cost to the character set size and therefore entropy.
Does this tool store or send the generated password anywhere?
No. The password is generated and displayed entirely in your browser and is never transmitted, logged, or stored — it exists only in the page's memory until you navigate away or refresh. Copy it into a password manager right after generating it.