Password Generator

Cryptographically strong passwords, generated on your device and never transmitted anywhere.

Click Generate to begin

Strength will appear here.

Randomness comes from crypto.getRandomValues(), the browser's cryptographically secure generator, not Math.random(). Passwords exist only in this tab's memory and are gone the moment you close it.

Features

  • Cryptographically secure randomness via the Web Crypto API
  • Length from 4 to 128 characters
  • Independent control of four character sets
  • Optional exclusion of visually ambiguous characters
  • Live entropy calculation in bits
  • Bulk generation up to 25 at once

How to use it

  1. Pick a length, 16 or more for anything that matters.
  2. Choose which character sets to include.
  3. Press Generate, then Copy.
  4. Paste it straight into your password manager.

What makes a password strong

Length beats complexity. A 20-character password drawn from lowercase letters alone has more entropy than a 10-character one using every symbol on the keyboard. Entropy is measured in bits: each bit doubles the number of guesses an attacker needs. Below 50 bits is weak, around 70 is reasonable, and above 100 bits is beyond any foreseeable brute-force attack.

The bigger risk is reuse. A perfect password used on two sites is only as safe as the less careful of the two. Generate a fresh one for every account and store them in a password manager rather than trying to remember them.

Frequently asked questions

Yes. No account, no limits, no paid tier. There is nothing to sign up for and nothing to install.
No, and this is the single most important thing about any online password generator. Passwords are produced by crypto.getRandomValues() running in your own browser and exist only in this tab's memory. There is no backend to receive them, no log and no database. Close the tab and they are gone. You can verify this by opening your browser's developer tools, switching to the Network tab, and generating a password, you will see no outbound request. Be sceptical of any password generator that cannot make the same claim.
They come from crypto.getRandomValues(), the browser's cryptographically secure random number generator, which draws from your operating system's entropy pool. This is deliberately not Math.random(), which is a predictable pseudo-random generator whose future output can be derived from previous values. The tool also uses rejection sampling rather than a simple modulo, which removes the small but systematic bias that would otherwise make some characters slightly more likely than others.
Length matters far more than complexity. A 20-character password using only lowercase letters has more entropy than a 10-character one using every symbol on the keyboard. Entropy is measured in bits, and each bit doubles the number of guesses an attacker needs: below 50 bits is weak, around 70 is reasonable, and above 100 bits is beyond any foreseeable brute-force attack. The bigger risk than length, though, is reuse, a perfect password used on two sites is only as safe as the less careful of the two.

Related tools

Further reading

📖 How long should a password actually be?

Read the full guide on the 123MiniApps blog.

Pick a theme

Ten hand-tuned palettes.