Password generator — strong random passwords, locally
Generate strong random passwords with your browser’s cryptographic random number generator. Nothing is transmitted or stored — the password exists only on your screen.
Runs entirely in your browser — nothing is uploaded.
All processing happens in your browser. Your file is never uploaded.
Generated with your browser's cryptographic random number generator (crypto.getRandomValues) — never with Math.random, which is predictable. The password exists only on this page: it is not transmitted, stored or logged, and reloading discards it. Every enabled character set is guaranteed to appear at least once, which some sites require. For real security, use a different password per site and let a password manager remember them — 20 random characters is beyond any practical guessing attack, but reuse defeats any password however strong.
How to use
- Pick a length. 20 characters is a strong default; go longer for anything critical.
- Choose character sets. Every enabled set is guaranteed to appear at least once.
- Check the strength readout. The entropy figure tells you how hard the password is to guess.
- Copy it. Then store it in a password manager, not a text file.
Questions
Is it safe to generate a password on a website?
On this one, yes, and you can verify the claim: the password is produced by your own browser with crypto.getRandomValues, the same generator used for encryption keys. It never touches a network request — the page works with the connection switched off — and it is not stored anywhere. Reloading the page destroys it.
How long should a password be?
For anything protected by rate limiting (a website login), 16 random characters is already far beyond guessing. For things attackable offline — an exported archive, a crypto wallet, a password manager vault — use 20 or more. Length beats cleverness: each added character multiplies the search space by the alphabet size.
What does the entropy number mean?
Bits of entropy measure how many guesses an attacker needs: n bits means 2ⁿ possibilities. 50 bits is crackable with serious offline hardware; 80 bits is out of practical reach; 100+ is out of theoretical reach for the foreseeable future. The figure shown assumes the attacker knows exactly which character sets you used — the honest assumption.
Why would I exclude look-alike characters?
If the password will ever be typed by hand or read over the phone — a Wi-Fi key, a device PIN — characters like 0/O and 1/l/I cause real mistakes. Excluding them costs about half a bit of entropy per character, which a slightly longer password more than repays.
Is a random password better than a passphrase?
Per character, yes; per memorability, no. Four random words are easier to remember than 12 random characters of similar strength. But the honest answer is that you should not be memorising passwords at all beyond one or two — a password manager remembers 200 random ones perfectly, and this generator is for feeding it.