Password Generator
Generate strong, random passwords locally in your browser.
—
What Is the Password Generator?
How Is the Password Generator Calculated?
Each character is chosen independently using crypto.getRandomValues(), a cryptographically secure random number source, from a pool built out of the character types you've enabled. Password strength is estimated from a combination of length and character variety — longer passwords using more character types are exponentially harder to guess or brute-force.
Password Generator Example
A 16-character password using uppercase, lowercase, numbers, and symbols has roughly 94^16 possible combinations — far beyond what brute-force attacks can feasibly try.
How to Use the Password Generator
Step 1
Adjust the length slider to your desired password length.
Step 2
Choose which character types to include.
Step 3
Optionally exclude ambiguous characters (I, l, 1, O, 0) for easier reading.
Step 4
Click Copy to copy the password, or Regenerate for a new one.
Benefits
- Uses the Web Crypto API for cryptographically secure randomness, not a predictable pseudo-random generator.
- Never sends the generated password to a server — it's created and stays entirely in your browser.
- Shows a live strength indicator based on length and character variety.
Common Password Generator Scenarios
Scenario 1
Creating a strong password for a new online account.
Scenario 2
Generating a one-off password for shared or temporary access.
Scenario 3
Replacing a weak or reused password flagged by a security check.
Understanding Your Result
The strength meter reflects estimated resistance to brute-force guessing, based on password length and the variety of character types used — it does not check the password against known breach databases, so still avoid reusing it across sites.
Tips
- Use at least 12-16 characters for accounts that don't support passkeys or hardware keys.
- Use a unique password per site along with a password manager, rather than memorizing variations.
- Enabling all four character types generally produces a stronger password than a longer password using fewer types.
Common Mistakes
- Reusing the same generated password across multiple accounts.
- Choosing a short length because it's easier to type, which weakens resistance to brute-force attacks.
- Assuming excluding ambiguous characters meaningfully increases security — it mainly helps readability, not strength.
Frequently Asked Questions
Is this password sent to a server or stored anywhere?
No, the password is generated and displayed entirely in your browser using the Web Crypto API, and is never transmitted or saved.
Is this random number generator actually secure?
Yes, it uses crypto.getRandomValues(), the same cryptographically secure randomness source used for browser security features, rather than Math.random().
What length password should I use?
Most security guidance recommends at least 12-16 characters with a mix of character types for important accounts.
Why is my strength meter still showing 'Weak' at a long length?
Strength also factors in character variety — try enabling more character types (uppercase, numbers, symbols) alongside a longer length.
Should I use the same generated password for multiple accounts?
No — always use a unique password for each account, since reusing passwords means a breach on one site could compromise all your other accounts using the same password.
What character types make a password stronger?
Including a mix of uppercase, lowercase, numbers, and symbols significantly increases the number of possible combinations, making a password much harder to guess or brute-force than one using only lowercase letters.
Should I write down or memorize my generated password?
Use a password manager to securely store generated passwords rather than writing them down in plain text or trying to memorize many complex passwords.
Is a longer password always better than a more complex shorter one?
Generally yes — length contributes more to a password's resistance against brute-force attacks than complexity alone, though a good balance of both length and character variety gives the strongest result.
Why do some websites reject certain special characters in passwords?
Some sites have outdated or overly restrictive password policies that limit which special characters are accepted — if a strong generated password is rejected, try regenerating with a narrower character set matching that site's requirements.
Important Information
Passwords are generated locally using the Web Crypto API and are never sent to or stored on a server.
Last updated: July 27, 2026