Skip to content

Secure Password Generator

Generate strong random passwords with your browser's cryptographically secure random number generator. Nothing is stored or transmitted.

Runs entirely in your browser. Nothing is uploaded.

New password generated

Weak≈ 0 bits of entropy · pool of characters

8 to 128 characters. 16 or more is recommended.

Step by step

How to use the Secure Password Generator

  1. 1

    Choose a length; 16 or more is recommended.

  2. 2

    Select which character types to include.

  3. 3

    Optionally exclude look-alike characters such as O, 0, l and 1.

  4. 4

    Generate a password, check its strength estimate and copy it into your password manager.

What it does well

Cryptographically secure

Uses crypto.getRandomValues with rejection sampling to avoid modulo bias. Math.random is never used.

Guaranteed character mix

Every selected character set appears at least once, placed at a random position.

Entropy-based strength

Strength is estimated from the real size of the character pool and the length, in bits.

Nothing retained

Passwords exist only in this page and disappear when you leave it.

Who uses it

Everyone
Create a unique password for each new account.
IT administrators
Issue strong temporary passwords and Wi-Fi keys.
Developers
Generate secrets for test environments.

What makes a password strong

Strength comes from unpredictability, measured in bits of entropy. A password chosen randomly from a pool of N characters with length L has L x log2(N) bits. A 16-character password using all 94 printable symbols has about 105 bits, far beyond what any attacker can brute-force. Length helps more than complexity: adding four characters typically adds more strength than adding symbols.

Humans are poor at randomness, which is why invented passwords follow predictable patterns. This generator uses the operating system's secure random source through the Web Crypto API, the same source used for encryption keys.

Security guidance

Use a different password for every account, store them in a reputable password manager and turn on multi-factor authentication wherever available. Never reuse a password that appeared in a data breach. When copying, be aware that your clipboard may be readable by other apps or synced across devices; paste the password promptly and copy something else afterwards if that is a concern.

Frequently asked questions

Are generated passwords saved or sent anywhere?

No. They are created in your browser and never stored, logged or transmitted.

How long should my password be?

At least 16 characters for important accounts. Longer is better if the site allows it.

Why exclude ambiguous characters?

Characters like O and 0 or l and 1 are easy to confuse when typing a password by hand. Excluding them slightly reduces entropy, which a longer length offsets.

Related tools