Password Generator
Generate a strong, random password using your browser's cryptographically secure random number generator.
How this password generator works
Passwords are generated using crypto.getRandomValues(), your browser's cryptographically secure random number source — not Math.random(), which is predictable enough to be unsuitable for anything security-sensitive. Because generation happens entirely in your browser, the password is never transmitted anywhere, including to this site's own server (which never sees it at all).
Why length matters more than complexity
A longer password with a smaller character set can be harder to brute-force than a shorter one crammed with symbols. Each additional character multiplies the number of possible combinations, so going from 12 to 16 characters increases crackability time far more than adding a couple of extra symbol types to a 12-character password. If a service allows it, prioritize length.
Ambiguous characters and where they matter
Some character sets include easily-confused characters like 0/O or l/1/I, which matter if a human will ever need to type the password manually (reading it off a screen or a printed recovery sheet) but don't matter at all if it's only ever pasted from a password manager. If this tool offers an option to exclude ambiguous characters, it's worth enabling for anything you might need to type by hand.
Frequently asked questions
Is the randomness here actually secure?
Yes — it uses the Web Crypto API's crypto.getRandomValues(), the same cryptographically secure random source browsers use for things like generating encryption keys, not the weaker Math.random().
Does this site see or store the passwords I generate?
No. Generation happens entirely in your browser's JavaScript; nothing is sent to any server, so there's nothing to intercept or log server-side.
How long should my password actually be?
Longer is generally better than more complex. For most modern services, 16+ characters with a mix of character types is a reasonable baseline, though always defer to a specific service's stated requirements.