Password Generator

Secure Password Generator

Create strong, random passwords right in your browser — nothing is sent anywhere, nothing is stored.

Your password

CorrectHorseBattery9!

—

Options

Password length 16

Uppercase (A–Z) Lowercase (a–z) Numbers (0–9) Symbols (!@#$...) Exclude ambiguous (l, 1, O, 0)

How this works: Passwords are generated entirely in your browser using your device's cryptographically secure random number generator (Web Crypto API) — nothing is transmitted to any server, logged, or stored. For best security, use a unique password for every account and store them in a reputable password manager rather than memorizing or reusing them.

How this tool works

This generator uses your browser's Web Crypto API — specifically crypto.getRandomValues() — rather than JavaScript's ordinary Math.random(). That distinction matters: Math.random() is a pseudo-random generator not designed for security purposes and can, in theory, be predicted; the Web Crypto API is built specifically for cryptographic use and is what your browser itself relies on for things like generating encryption keys.

The strength meter isn't cosmetic — it calculates actual entropy in bits based on your password's length and the character pool you've selected, then maps that to a Weak/Fair/Strong/Very strong label. Longer passwords with a wider mix of character types will always score higher, which is why the length slider has more real impact on security than any single toggle.

Frequently asked questions

Is it really safe to generate passwords in a browser?
Yes, when the randomness source is cryptographically secure (as this one is) and nothing is transmitted anywhere — which is the case here. The password never leaves your device; there's no server call involved in generating it.

Why exclude "ambiguous" characters like l, 1, O, and 0?
Those characters can look identical in certain fonts, which causes real problems if you're ever typing a password from a printed copy or reading it aloud to someone. It's a small trade-off in randomness for a meaningful reduction in transcription errors.

How long should my password actually be?
Most current guidance favors length over complexity — a 16+ character password with a mix of character types is generally considered strong for most accounts, and longer is better for anything sensitive like a password manager's master password or financial accounts.

Should I reuse a strong password across multiple sites?
No — even a very strong password becomes a liability if it's reused, since a breach at one site can then be used to access every other account using the same password. A password manager is the practical way to use a different strong password everywhere without memorizing dozens of them.

Does this tool save or log the passwords I generate?
No. Nothing is stored, logged, or sent anywhere — once you navigate away from the page, the password exists only wherever you've copied it to.

You might also like

JWT Decoder · QR Code Generator