Password Generator
Generate strong, random passwords locally using a cryptographically secure random number generator.
Your files are processed locally in your browser and are not uploaded to our servers. Every password is generated using crypto.getRandomValues(), the Web Crypto API's cryptographically secure random number generator, entirely in your browser. Nothing is ever transmitted, logged, or stored anywhere — including by this site itself.
How to use Password Generator
Choose a length from 4 to 128 characters and pick which character sets to include — uppercase, lowercase, numbers, and symbols — then get an instantly generated password, ready to copy with one click. Every random choice is made using the browser's Web Crypto API (`crypto.getRandomValues()`), a cryptographically secure random number generator, rather than `Math.random()`, which is predictable and unsuitable for anything security-related. An optional "exclude ambiguous characters" setting removes visually confusable characters like `0`, `O`, `1`, `l`, and `I`.
Key features
- Cryptographically secure randomness via crypto.getRandomValues()
- Adjustable length from 4 to 128 characters
- Toggleable character sets — uppercase, lowercase, numbers, symbols
- Optional exclusion of visually ambiguous characters
- Simple, honestly-labeled strength indicator
- One-click copy, with a short session history of recent passwords
Practical use cases
- Creating a strong password for a new online account
- Generating a passphrase for a password manager's master password
- Creating a random API key or secret for a personal project
- Generating a temporary password to share securely with a teammate
Supported formats
Accepted: password
Limitations
- Generates high-entropy random strings, not memorable word-based passphrases
- A generated password is only as secure as how it's stored and transmitted afterward, which is outside this tool's control
Frequently asked questions
- Is this password generator secure?
- Yes. It uses the Web Crypto API's crypto.getRandomValues(), a cryptographically secure random source, for every random choice it makes — which character to pick and how to shuffle the result. It never uses Math.random(), which is predictable and unsuitable for security purposes.
- Are my generated passwords stored or sent anywhere?
- No. Password generation, display, and copying all happen entirely in your browser. Nothing is ever transmitted to a server, logged, or stored anywhere, including by this site itself.
- What makes a password strong?
- Length and character-set diversity matter most — a longer password drawing from uppercase, lowercase, numbers, and symbols is far harder to guess or brute-force than a short one using only letters. The strength indicator here is a simple heuristic based on those two factors, not a rigorous cryptographic entropy calculation.
- Should I exclude ambiguous characters?
- It's a convenience option, not a security one. Excluding characters like 0, O, 1, l, and I makes a password easier to read and type correctly by hand — useful if you'll ever need to enter it manually — at a very slight cost to the size of the character pool.
Related tools
Part of Coding Tools