Password Generator
Generate strong, cryptographically-random passwords with custom length, character sets and a strength meter.
Runs entirely in your browser — your input never leaves your deviceAbout this tool
This password generator builds strong, unpredictable passwords using the browser's cryptographically secure random source (crypto.getRandomValues) — not the predictable Math.random() many generators rely on. It draws each character without modulo bias, guarantees at least one character from every set you enable, then shuffles the result so the password is uniformly random.
Choosing a strong password
- Length matters most. Every extra character multiplies the number of possible passwords. 16+ characters is a good default; 20+ for anything critical.
- Mix character sets. Uppercase, lowercase, numbers and symbols together enlarge the pool and raise entropy.
- Use a unique password per account, ideally stored in a password manager, so one breach can't unlock everything.
The strength meter shows the estimated entropy in bits — the higher the number, the harder the password is to guess or brute-force. Above 60 bits is strong; above 80 bits is very strong.
Frequently asked questions
Are these passwords safe and truly random?
Yes. They are generated with the browser's cryptographically secure random number generator (crypto.getRandomValues) using unbiased sampling — the same class of randomness used for security keys. Weak generators that use Math.random() are predictable; this one is not.
Is my password sent anywhere?
No. Passwords are generated entirely in your browser on your device and are never transmitted, logged or stored on any server. Reload the page and they're gone.
What length should my password be?
For most accounts, 16 characters with mixed character sets is strong. For high-value accounts (email, banking, crypto) use 20 or more. Length increases strength faster than any other setting.
What does 'exclude similar characters' do?
It removes easily-confused characters like the letter O and the number 0, or lowercase l and the number 1. This is handy when a password has to be read aloud or typed by hand, at a small cost to the character pool.
What do the 'bits' in the strength meter mean?
Bits measure entropy — roughly, how many yes/no guesses it would take to find the password. Each extra bit doubles the difficulty. Under 40 bits is weak, 60+ is strong, and 80+ is very strong.
Should I use a password manager?
Yes. The safest approach is to generate a unique, long password for every account and store them in a reputable password manager, so you only need to remember one master password.
Related developer tools
Explore more free tools
Every category runs free in your browser — nothing is uploaded.