Password Generator
Processed locally · Never leaves your browserGenerate strong, secure passwords with customizable options. All passwords are created locally in your browser.
Generated Password
Click generate to create a password
Password Options
16
Recommended: 16+ characters
Password Security Tips
Do
- Use at least 16 characters
- Mix uppercase and lowercase
- Include numbers and symbols
- Use unique passwords for each account
Don't
- Use personal information
- Reuse passwords
- Use common words or patterns
- Share passwords with others
Runs entirely in your browser — nothing is uploaded
Runs in your browser
Runs entirely in your browser. No uploads. Your files stay private.
How to Create a Strong Password
Password Generator uses crypto.getRandomValues() — the Web Crypto API's cryptographically secure pseudo-random number generator (CSPRNG) — to pick each character. This is the same primitive browsers use for TLS key generation and is seeded by the operating system's entropy pool (/dev/urandom on Linux/macOS, CryptGenRandom on Windows). Math.random() is never used, because it's not cryptographically secure and is predictable from a few outputs.
Password strength is measured in bits of entropy: entropy = length × log2(charset size). A 12-character password drawn from the full 94-character printable ASCII set has 12 × log2(94) ≈ 78.6 bits of entropy — enough to resist any practical offline attack against a properly hashed password. Dropping to lowercase only (26 chars) collapses that to about 56 bits, which a high-end GPU farm can chew through against weak hashing schemes.
Each toggle adds characters to the source pool used by the random sampler: lowercase (26), uppercase (26), digits (10), and a curated symbol set (about 32 characters depending on browser). With all four enabled and length 16, you get roughly 105 bits of entropy — enough to make brute force computationally infeasible for the foreseeable future.
Length matters more than complexity. A 20-character all-lowercase password (≈94 bits) is stronger than a 10-character password with all four character classes (≈65 bits). NIST SP 800-63B no longer requires periodic rotation or composition rules and instead emphasizes length and uniqueness, which this tool is designed around.
The 'exclude similar characters' option removes 1, l, I, 0, O to prevent transcription mistakes when typing from a printed list — useful for Wi-Fi passwords or recovery codes that humans need to read aloud. Doing so reduces the charset by a few characters and slightly lowers entropy per character, but for length 16+ the impact is negligible.
Generated passwords never leave the browser. There's no fetch call, no analytics event with the value, and no history stored in localStorage. Each click of Generate produces a fresh password that exists only in this tab's memory until you copy or replace it.
For practical use, pair this generator with a password manager (Bitwarden, 1Password, KeePassXC) to store the output. Reusing passwords across sites is the single biggest factor in real-world account compromises — a unique strong password per site, plus a manager, beats memorization every time.
Common Use Cases
01
Account registration
Generate a unique high-entropy password for each new account to defeat credential stuffing from data breaches.
02
Wi-Fi network passphrase
Create a long passphrase for your home or office router that resists offline WPA2/WPA3 dictionary attacks.
03
Database and API keys
Produce long random strings suitable for service credentials, API secrets, and encryption key derivation salts.
04
Password policy compliance
Meet enterprise requirements (12+ chars, mixed classes) using the toggles instead of memorizing rules.
Frequently Asked Questions
At least 12 characters with all four classes enabled gets you ~78 bits of entropy, which is fine for most accounts. For master passwords, encryption keys, or accounts that store sensitive data, use 20+ characters (~130 bits).
No. Each call to crypto.getRandomValues() runs in the browser's memory, the result is rendered into the input box, and nothing is logged, fetched, or persisted. Refresh the page and the password is gone.
If the site allows them, yes. Each symbol adds about log2(32/94) ≈ 1.5 bits per character relative to alphanumeric-only. But a longer alphanumeric password is just as strong — the math favors length over complexity.
This tool runs entirely client-side using the Web Crypto API, the same primitive your browser uses for TLS. The values never leave your device. Online generators that send the password to a server are unsafe; this one does not.
Math.random uses a non-cryptographic PRNG (typically xorshift128+) that's seeded predictably and outputs values that can be reverse-engineered from a few samples. crypto.getRandomValues pulls from the OS entropy pool and is unpredictable even given prior outputs.
The meter weighs both length and character diversity. A long but lowercase-only password may register as medium because dropping to a 26-char alphabet halves the per-character entropy. Enable more classes or increase length to reach 'strong'.
Statistically no. With ~105 bits of entropy at length 16, the probability of collision across the lifetime of all humans is effectively zero. Each click produces an independent draw from the CSPRNG.
It removes 1, l, I, 0, and O from the source pool to prevent typo errors when reading the password aloud or transcribing from print. Entropy per character drops slightly but is recovered by adding one or two characters of length.
Modern guidance from NIST (SP 800-63B) is to rotate only on suspected compromise, not on a fixed schedule. Forced rotation often leads to weaker passwords because users append a number or month. Use long, unique passwords stored in a manager instead.
In a password manager like Bitwarden, 1Password, or KeePassXC. The point of long random passwords is that you don't have to remember them — the manager autofills them per site, and you only memorize the master password.
Step-by-step guide
How to generate a strong password
Walk through every step with screenshots, format-specific tips, and the platform-by-platform limits you need to know.
Advertisement