Password Generator
Generate strong, secure passwords with customizable options. All passwords are created locally in your browser.
100% private
Generate cryptographically random passwords using the browser's Crypto.getRandomValues — not Math.random, which is predictable and unsafe for any secret. Adjust the length and character classes (uppercase, lowercase, digits, symbols). A visual strength indicator (Weak / Medium / Strong) reflects both length and character diversity. The generated password is rendered in your tab and only your tab — secrets are not transmitted off-device, which is the entire point of generating one.
Generated Password
Click generate to create a password
Password Options
16
Recommended: 16+ characters
Password Security Tips
Do
- Use at least 16 characters
- Mix uppercase and lowercase
- Include numbers and symbols
- Use unique passwords for each account
Don't
- Use personal information
- Reuse passwords
- Use common words or patterns
- Share passwords with others
Runs in your browser
Runs right inside your browser tab. No uploads. Your files stay private.
How to Create a Strong Password
Password Generator uses crypto.getRandomValues() — the Web Crypto API's cryptographically secure pseudo-random number generator (CSPRNG) — to pick each character. This is the same primitive browsers use for TLS key generation and is seeded by the operating system's entropy pool (/dev/urandom on Linux/macOS, CryptGenRandom on Windows). Math.random() is never used, because it's not cryptographically secure and is predictable from a few outputs.
Password strength is measured in bits of entropy: entropy = length × log2(charset size). A 12-character password drawn from the 88-character set used here (uppercase + lowercase + digits + 26 symbols) has 12 × log2(88) ≈ 77.5 bits of entropy — enough to resist any practical offline attack against a properly hashed password. Dropping to lowercase only (26 chars) collapses that to about 56 bits, which a high-end GPU farm can chew through against weak hashing schemes.
Each toggle adds characters to the source pool used by the random sampler: lowercase (26), uppercase (26), digits (10), and a curated 26-character symbol set. With all four enabled and length 16, you get roughly 103 bits of entropy — enough to make brute force computationally infeasible for the foreseeable future.
Length matters more than complexity. A 20-character all-lowercase password (≈94 bits) is stronger than a 10-character password with all four character classes (≈65 bits). NIST SP 800-63B no longer requires periodic rotation or composition rules and instead emphasizes length and uniqueness, which this tool is designed around.
Generated passwords never leave the browser. There's no fetch call, no analytics event with the value, and no history stored in localStorage. Each click of Generate produces a fresh password that exists only in this tab's memory until you copy or replace it.
For practical use, pair this generator with a password manager (Bitwarden, 1Password, KeePassXC) to store the output. Reusing passwords across sites is the single biggest factor in real-world account compromises — a unique strong password per site, plus a manager, beats memorization every time.
Common Use Cases
01
Account registration
Generate a unique high-entropy password for each new account to defeat credential stuffing from data breaches.
02
Wi-Fi network passphrase
Create a long passphrase for your home or office router that resists offline WPA2/WPA3 dictionary attacks.
03
Database and API keys
Produce long random strings suitable for service credentials, API secrets, and encryption key derivation salts.
04
Password policy compliance
Meet enterprise requirements (12+ chars, mixed classes) using the toggles instead of memorizing rules.
Frequently Asked Questions
At least 12 characters with all four classes enabled gets you ~77.5 bits of entropy, which is fine for most accounts. For master passwords, encryption keys, or accounts that store sensitive data, use 20+ characters (~129 bits).
No. Each call to crypto.getRandomValues() runs in the browser's memory, the result is rendered into the input box, and nothing is logged, fetched, or persisted. Refresh the page and the password is gone.
If the site allows them, yes. Expanding the charset from 62 (alphanumeric) to 88 (with symbols) adds roughly 0.5 bits per character. But a longer alphanumeric password is just as strong — the math favors length over complexity.
It depends on the implementation. This one draws from window.crypto.getRandomValues — the same Web Crypto primitive your browser uses to negotiate TLS session keys — and keeps the generated value inside the page's JavaScript memory until you copy it. Open the Network tab in DevTools while you generate: no request fires. Generators that submit a form and return a password are doing it wrong: by the time the value reaches your screen it has already passed through someone else's web server, almost certainly through a CDN cache, and very likely through an access log. Avoid those.
Math.random uses a non-cryptographic PRNG (typically xorshift128+) that's seeded predictably and outputs values that can be reverse-engineered from a few samples. crypto.getRandomValues pulls from the OS entropy pool and is unpredictable even given prior outputs.
The meter weighs both length and character diversity. A long but lowercase-only password may register as medium because dropping to a 26-char alphabet halves the per-character entropy. Enable more classes or increase length to reach 'strong'.
Statistically no. With ~103 bits of entropy at length 16 with all character classes enabled, the probability of collision across the lifetime of all humans is effectively zero. Each click produces an independent draw from the CSPRNG.
Modern guidance from NIST (SP 800-63B) is to rotate only on suspected compromise, not on a fixed schedule. Forced rotation often leads to weaker passwords because users append a number or month. Use long, unique passwords stored in a manager instead.
In a password manager like Bitwarden, 1Password, or KeePassXC. The point of long random passwords is that you don't have to remember them — the manager autofills them per site, and you only memorize the master password.
Step-by-step guide
How to generate a strong password
Walk through every step with screenshots, format-specific tips, and the platform-by-platform limits you need to know.
Advertisement