Each character is chosen independently using crypto.getRandomValues, with rejection sampling applied so every character in the selected set has an exactly equal chance of being picked — never Math.random(), which isn’t designed to be unpredictable. The strength estimate is a rough entropy calculation — password length multiplied by the base-2 logarithm of how many characters are in play — labeled from Weak to Very strong at increasing bit thresholds. Everything runs in your browser; nothing is sent to a server.
Password Generator
Generate strong, random passwords with adjustable length and character sets, entirely in your browser.
Generated password
Select at least one character set below.
16
864
How this generator works
Frequently asked questions
Is this actually secure, or just for show?
It's actually secure. Every character is picked using crypto.getRandomValues, the same cryptographically-secure randomness source browsers use for security-sensitive operations like generating encryption keys — unlike Math.random(), which is fast but predictable enough that it's explicitly documented as unsuitable for anything security-related. The selection also uses rejection sampling to avoid the slight bias a naive modulo would introduce.
Does this store or transmit the passwords it generates?
No. Password generation happens entirely in your browser — nothing is sent to a server, stored, or logged anywhere. Closing or refreshing the page discards it completely, so make sure you've copied or saved a password somewhere safe before you navigate away.
How long should my password be?
16 characters with all character sets enabled is a solid default for most accounts. For anything protecting sensitive data, 20+ characters is safer, and the strength indicator's entropy-bit estimate gives you a rough sense of how much guessing an attacker would need to do. Where you can, a password manager generating a unique long password per site beats memorizing anything.
What does "exclude ambiguous characters" do and when should I use it?
It removes characters that are easy to misread in certain fonts or contexts — zero vs. capital O, the digit one vs. lowercase L vs. capital I, and the vertical bar vs. lowercase L. Turn it on when a password has to be typed by hand from a printed sheet, read aloud over the phone, or entered on a device where the font makes these characters hard to tell apart.
Why did my password change when I just toggled a checkbox?
Changing the length or any character-set option immediately generates a fresh password using the new settings, rather than leaving a password on screen that no longer matches what's selected. Use the Regenerate button any time you want a new password without changing any settings.