Numarly

Password Generator

Generate strong, random passwords locally in your browser.

—

What is it?

This tool generates strong, random passwords entirely in your browser using the Web Crypto API, with adjustable length and character type options.

Formula Explanation

Each character is chosen independently using crypto.getRandomValues(), a cryptographically secure random number source, from a pool built out of the character types you've enabled. Password strength is estimated from a combination of length and character variety — longer passwords using more character types are exponentially harder to guess or brute-force.

Example Calculation

A 16-character password using uppercase, lowercase, numbers, and symbols has roughly 94^16 possible combinations — far beyond what brute-force attacks can feasibly try.

How to Use

  1. Adjust the length slider to your desired password length.
  2. Choose which character types to include.
  3. Optionally exclude ambiguous characters (I, l, 1, O, 0) for easier reading.
  4. Click Copy to copy the password, or Regenerate for a new one.

Benefits

  • Uses the Web Crypto API for cryptographically secure randomness, not a predictable pseudo-random generator.
  • Never sends the generated password to a server — it's created and stays entirely in your browser.
  • Shows a live strength indicator based on length and character variety.

Use Cases

  • Creating a strong password for a new online account.
  • Generating a one-off password for shared or temporary access.
  • Replacing a weak or reused password flagged by a security check.

What Your Result Means

The strength meter reflects estimated resistance to brute-force guessing, based on password length and the variety of character types used — it does not check the password against known breach databases, so still avoid reusing it across sites.

Tips

  • Use at least 12-16 characters for accounts that don't support passkeys or hardware keys.
  • Use a unique password per site along with a password manager, rather than memorizing variations.
  • Enabling all four character types generally produces a stronger password than a longer password using fewer types.

Common Mistakes

  • Reusing the same generated password across multiple accounts.
  • Choosing a short length because it's easier to type, which weakens resistance to brute-force attacks.
  • Assuming excluding ambiguous characters meaningfully increases security — it mainly helps readability, not strength.

FAQs

Is this password sent to a server or stored anywhere?

No, the password is generated and displayed entirely in your browser using the Web Crypto API, and is never transmitted or saved.

Is this random number generator actually secure?

Yes, it uses crypto.getRandomValues(), the same cryptographically secure randomness source used for browser security features, rather than Math.random().

What length password should I use?

Most security guidance recommends at least 12-16 characters with a mix of character types for important accounts.

Why is my strength meter still showing 'Weak' at a long length?

Strength also factors in character variety — try enabling more character types (uppercase, numbers, symbols) alongside a longer length.

Passwords are generated locally using the Web Crypto API and are never sent to or stored on a server.

Last updated: July 27, 2026