Developer
Password Generator
Strong random passwords with full control over length and character sets.
A password is only as strong as the randomness behind it, and humans are terrible at randomness. Keyboard patterns, names, dates and substitutions follow habits that cracking tools model extremely well. This generator takes its characters from the browser's cryptographic random source, which is seeded by the operating system.
The important detail is that generation happens entirely offline, in the page. A password is the one secret where sending it to a website to be built is exactly backwards — anything the server sees, the server has. Nothing you generate here is transmitted, logged or stored.
How to use it
- Set the length. 16 characters is a sensible default for anything that matters; 20 or more if you are not typing it by hand.
- Choose which character sets to include. Mixing upper case, lower case, digits and symbols widens the search space, but some sites reject symbols — turn them off if a form complains.
- Tick Avoid look-alike characters if you will be reading the password off one screen and typing it into another. It removes
I l 1 O 0 o. - Press Generate until you get one you can live with. Every press produces a fresh password from scratch.
- Read the strength line. It reports the estimated search space in bits, which is the honest measure — not a coloured bar with no meaning.
- Copy it straight into your password manager. If you have no manager yet, that is the single highest-value security upgrade available to you.
Questions
How random is this really?
Characters come from crypto.getRandomValues, the browser's cryptographically secure random number generator, with rejection sampling so that every character in the set has an equal chance. It does not use Math.random, which is predictable and unsuitable for secrets.
How long should a password be?
Length beats complexity. A 16-character password drawn from the full set is beyond the reach of practical brute force; 20 characters makes it comfortably permanent. A site that caps you at 8 characters is the weak point, not you.
Is it safe to use a website for this?
Only if the page does the work locally, as this one does. There is nothing to trust here because there is no request: open your browser's network tab and generate a password, and you will see no traffic.
What about passphrases?
Four or five unrelated words are easier to remember and, at that length, at least as strong as a short random string. This tool generates character passwords; for passphrases, pick words with genuine randomness rather than a story you invented.
Should I reuse one strong password everywhere?
No. Reuse is how one breached site becomes every account you own. Use a password manager so each service has its own password and you only have to remember one.