Generator
Password Generator
Generate strong random passwords in your browser from the character sets you choose. Nothing you create is sent to a server.
Passwords are generated entirely in your browser. Nothing is sent to the server.
How generation works
Builds a random password from the character sets you enable (lowercase, uppercase, digits, symbols) using crypto.getRandomValues with rejection sampling, so each character is drawn without simple modulo bias. Length is clamped between 8 and 128. When length allows, the generator also places at least one character from each enabled set, then shuffles. Ambiguous look-alikes like 0/O and 1/l/I are omitted by default; you can include them when a site requires the full alphabet. The panel shows a rough entropy estimate (length × log2 of alphabet size). That is a math estimate, not a guarantee against cracking. Use it when you need a fresh credential for a new account, staging login, or local test user, then store the result in a password manager rather than a chat or sticky note.
How to use it
Set length and character sets, leave ambiguous characters off unless the site requires them, then Regenerate until you like a candidate. Copy once into your password manager. Nothing is uploaded.
Assumptions
Entropy is length × log2(alphabet size) assuming independent uniform draws. It is a planning estimate, not a guarantee. Generation requires a browser with crypto.getRandomValues.
Sample run
Input
Length 20, lower + upper + digits, ambiguous off
Output
A random 20-character string such as kT9mW2pQxR7nHvB4sL, plus a rough bit estimate
More typical runs
- Length 20 with lower, upper, and digits for a new account password.
- Generate several candidates, then copy one into your password manager.
Practical use cases
- Creating a password for a new SaaS account you will store in a password manager before the onboarding call ends.
- Minting disposable local test credentials for a staging environment you will discard after the session.
- Rotating a shared staging secret that you will paste into a vault immediately, not into Slack.
- Generating several candidates so a teammate can pick one that passes a site’s character rules.
Limitations
Does not store, sync, or remember passwords. Does not check against breach lists. Site-specific character rules may still reject a generated string.
Common questions
- Are look-alike characters included?
- Not by default. Ambiguous look-alikes such as 0/O and 1/l/I are omitted to reduce copy mistakes. Turn on Include ambiguous when the destination requires them.
- What does the entropy number mean?
- It is length times log2 of the alphabet size, assuming independent uniform draws. It is a planning estimate, not a promise that a password is uncrackable.
- Is this safe enough for production accounts?
- Yes for generating strong random strings locally. Store the result in a password manager and never reuse it across sites. This page does not remember or sync passwords.
- Why is length capped at 128?
- Most services accept far shorter passwords. The upper bound keeps the output manageable to copy while still covering uncommon long-password policies.
- Can the site see the password I generated?
- No. Generation runs in your browser with crypto.getRandomValues. Nothing is uploaded; close the tab if you are on a shared screen.
Generators run with browser crypto and do not store results on our servers. How our tools work · Editorial policy · Contact