Generate cryptographically secure passwords
The Password Generator creates strong, random passwords entirely in your browser using rules you control. You set the length (typically 8 to 64+ characters) and toggle which character sets to include: lowercase (a-z), uppercase (A-Z), digits (0-9), and symbols (such as !@#$%^&*). Optional switches let you exclude ambiguous characters like l, I, 1, O, and 0, or require at least one character from each selected set so the result always meets common composition policies.
It is built for anyone who needs a fresh, unguessable credential on the spot: developers seeding database or API accounts, sysadmins rotating service and root passwords, and everyday users creating unique logins for each site. Because generation happens locally with the browser's cryptographic randomness, the password never has to travel over the network to be created.
The tool draws characters from the pool you assemble by selecting character sets. Randomness comes from the Web Crypto API (crypto.getRandomValues), a cryptographically secure source, rather than Math.random, so the output is suitable for security-sensitive use. Each position in the password is filled by picking uniformly from the combined pool, and when 'require each type' is enabled the generator guarantees one character from each chosen set before filling the remainder and shuffling.
Password strength is measured in entropy bits, calculated as length multiplied by log2 of the pool size. For example, a pool of 26 lowercase + 26 uppercase + 10 digits + roughly 30 symbols gives about 92 possible characters, so log2(92) is about 6.52 bits per character. A 16-character password from that pool carries roughly 104 bits of entropy, which is far beyond the reach of brute-force attacks with current hardware. Adding length increases entropy faster than restricting the pool reduces it, which is why length is usually the most important setting.
Yes, it is completely free to use. Password generation runs entirely in your browser using local JavaScript and the Web Crypto API, so the passwords are never sent to, stored on, or logged by any server.
For important accounts, use at least 12 to 16 characters. Longer is stronger: each added character multiplies the number of possible combinations, so a 20-character password is dramatically harder to crack than a 10-character one.
Characters like the lowercase l, uppercase I, the digit 1, uppercase O, and the digit 0 look similar in many fonts. Excluding them prevents transcription errors when a password must be typed or read aloud, at a small cost to entropy.
They are generated with crypto.getRandomValues, the browser's cryptographically secure random number generator, not the predictable Math.random. This makes the output unpredictable and appropriate for real security use.
Symbols increase the character pool and therefore strength, so enable them when allowed. If a site rejects certain symbols, turn off the symbol set or increase the length with letters and digits to compensate for the smaller pool.
No. Each generation is independent and random, so there is no way to reproduce a previous result. Copy the password and save it in a password manager before leaving the page.
No. Even a strong password becomes a liability if reused, because a breach on one site exposes every account sharing it. Generate a unique password for each service.