Password Generator
Strength: Very strong (~103 bits of entropy)
Generates a random password using crypto.getRandomValues() - the Web Crypto API's cryptographically secure random number source, not Math.random(), which isn't safe for this. Everything happens in this browser tab; nothing is sent anywhere, logged, or saved after you leave the page.
How to use it
- Set the length and which character types to include.
- A password generates automatically - check the strength estimate below it.
- Click the refresh icon (or "Generate New Password") for a different one with the same settings.
- Click the copy icon to copy it to your clipboard.
Frequently asked questions
Is the password sent to a server to generate it?
No - it's generated entirely in your browser using crypto.getRandomValues(), the Web Crypto API's cryptographically secure random number generator. Nothing is transmitted anywhere, and nothing is logged.
Is this actually secure, or just "secure enough"?
It uses the same underlying randomness source (crypto.getRandomValues) that browsers use for things like generating encryption keys - not Math.random(), which isn't safe for this. The strength meter below shows the actual entropy in bits for what you've generated.
What does "exclude ambiguous characters" do?
It removes characters that are easy to misread or mistype, like 0 (zero) vs O (capital O), or 1 (one) vs l (lowercase L) vs I (capital I) - useful for a password you'll need to type by hand rather than paste.
Should I reuse this password across multiple sites?
No - use a unique password per site, ideally saved in a password manager. This tool generates one password at a time; it doesn't store or track what you've generated.
Why is there no password history or save feature?
By design - a tool that remembers passwords you've generated is a tool that has a copy of your passwords somewhere. Copy it when you generate it; nothing here persists after you leave the page.