Password Generator
Generate strong, random passwords with custom length and character sets — cryptographically secure, never sent to a server.
Configure length and character sets, then click Generate. Passwords are generated using crypto.getRandomValues() — cryptographically secure, never sent to a server.
What is Password Generator?
Password Generator creates cryptographically secure random passwords using your browser's built-in `crypto.getRandomValues()` — the same entropy source used for cryptographic operations. Configure length from 4 to 128 characters, choose which character sets to include (uppercase, lowercase, numbers, symbols), and generate up to 10 passwords at once.
A strength indicator grades each password based on length and variety. Every password is guaranteed to contain at least one character from each selected set — so a password with all four sets enabled will always include at least one uppercase, one lowercase, one digit, and one symbol. No data is ever sent to a server.
Common Use Cases
- Generating a strong master password for a password manager
- Creating a random API key or secret token for a service
- Producing a temporary password to share with a new user
- Generating multiple password options to pick from
- Creating a passphrase-length random string for high-security accounts
How to Use Password Generator
- Set the password length using the slider — 16 characters is a good default for most accounts.
- Toggle which character sets to include: uppercase, lowercase, numbers, and symbols.
- Click Generate and copy the password. Use a password manager to store it.
Related Tools
FAQ
Is this password generator truly random?
Yes — passwords are generated using `crypto.getRandomValues()`, the browser's cryptographically secure pseudo-random number generator (CSPRNG). This is the same source used for TLS key generation and other cryptographic operations. It is far stronger than Math.random(), which is not cryptographically secure and should never be used for passwords.
How long should my password be?
Security experts recommend a minimum of 12–16 characters for most accounts. For high-value accounts (email, banking, password manager master password), use 20+ characters. Length matters more than complexity — a 20-character lowercase-only password is harder to brute-force than an 8-character password with symbols.
Are the passwords sent to your server?
No — all generation happens entirely in your browser using the Web Crypto API. No password ever leaves your device. You can verify this by disconnecting from the internet after loading the page — it still works.
Should I use a password manager?
Yes. A password manager (like Bitwarden, 1Password, or Dashlane) lets you use a different strong password for every account without memorising them. The generator is most useful when paired with a password manager — generate, copy, and save the password directly without typing it anywhere.
What makes a password 'strong'?
Strength comes from two factors: length (more characters = exponentially more guesses to brute-force) and unpredictability (random is better than dictionary words or personal info). A 16-character fully random password with mixed character sets has roughly 95¹⁶ ≈ 4 × 10³¹ possible values — infeasible to brute-force even with specialised hardware.