Password Generator 🔒 Your data never leaves your browser.
Strong random passwords with your rules — length, symbols, count.
About this tool
Every password comes from crypto.getRandomValues() — the cryptographically secure random source built into your browser — with modulo-bias-free sampling. The entropy readout tells you how strong each password actually is: 60+ bits resists online attacks, 80+ bits is safe against offline cracking for years.
Passwords are generated on your device and never transmitted, logged or stored. Prefer a password manager for day-to-day accounts — and use this when you need a strong secret right now.
Frequently asked questions
Are these passwords cryptographically random?
Yes. Every character and word is chosen with the browser's Web Crypto API (crypto.getRandomValues), using rejection sampling to avoid modulo bias — not Math.random(), which is not safe for generating secrets.
What actually makes a password "strong"?
Length and character variety, which together determine entropy — the number of bits of randomness. The strength meter estimates entropy directly from your settings and shows an approximate offline-cracking time at 10¹⁰ guesses per second, a common benchmark for GPU-based attacks.
Should I use random characters or a passphrase?
Both are strong when long enough. A passphrase (e.g. five random dictionary words) is easier to type and remember; a random-character string packs slightly more entropy per character. Pick whichever a given site accepts, since a password you'll actually use correctly beats a theoretically stronger one you mistype.
Are my generated passwords stored or sent anywhere?
No. Passwords are generated and displayed entirely in your browser and never saved. Only your settings — length, character sets, and so on — are remembered locally so the tool reopens the way you left it.
Why exclude ambiguous characters like 0, O, 1, l, I?
They're easy to misread in certain fonts, which leads to mistyped passwords when copying from paper or reading one aloud over the phone. Turn on "Exclude ambiguous" to drop them automatically, or use the exclude-characters field for anything else a specific system rejects.