Security Tools
Create strong, random passwords and other security helpers — every step runs locally in your browser, nothing is uploaded.
1 tool
Password strength is a property of how a password was generated, not of how it looks. A nine-character string containing two symbols is often weaker than a four-word passphrase, because what resists guessing is the size of the space the value was drawn from — its entropy in bits — and that space grows far faster with length than with the size of the character set.
This space is reserved for a sponsor. Every tool on this site stays free and runs locally in your browser.
About Security Tools
The second principle is location. A password generated by a server has travelled over a network and existed in somebody else's memory; a password generated in your browser from the platform's cryptographic random source has not. Every generator here draws on the operating system's secure randomness rather than a seeded pseudo-random function, and none of them transmits its output.
The third is that generation is only part of the problem. A strong password reused across ten sites is one breach away from ten compromised accounts, and the practical answer is a password manager with a unique value per site. At that point the only secrets you need to memorise are a small number of long passphrases, and the generated values can be long and unmemorable without causing inconvenience.
Frequently asked questions
Is my generated password sent anywhere?
No. Generation and the strength calculation happen in the page using the browser's Web Crypto random source, and there is no request that carries the value. Disconnecting the network and generating again is a quick way to confirm it. This matters because a generator that transmitted its output would become a single point of failure for every account that had used it.
How is the randomness produced?
From the platform's cryptographically secure generator, crypto.getRandomValues, which draws entropy from the operating system and is the same primitive used for session keys and nonces. Characters are selected by rejection sampling rather than by taking a modulus, because a plain modulo operation over an alphabet whose size is not a power of two makes some characters marginally more likely than others, quietly reducing the entropy the password actually has.
How long should a password be?
Current guidance, including NIST SP 800-63B, sets a minimum of eight characters, recommends permitting at least 64, and judges strength by length and by comparison against known-breached lists rather than by composition rules. For a password that must be typed by hand, length is the lever: every added character multiplies the search space by the alphabet size, so going from twelve characters to sixteen adds far more difficulty than adding symbols to a twelve-character value. For a generated value stored in a manager, longer is close to free.
Should I use a passphrase instead?
Often, yes, if the value has to be memorised. A passphrase drawn from randomly chosen words carries more entropy than people expect, because the space is the list size raised to the number of words: six words from a 7,776-word list is about 77 bits, beyond practical guessing. The catch is that the words must be selected at random rather than by you, since humans choose predictable words. That is precisely why a passphrase generator is more trustworthy than a passphrase invented on the spot.
What about excluding ambiguous characters?
It is a usability setting rather than a security one, and it slightly shrinks the alphabet — and therefore the entropy — in exchange for removing the 0/O and 1/l/I confusions that cause failed logins when a value is read off a screen and typed elsewhere. Use it for anything that will be transcribed by hand; skip it for a value stored and pasted by a password manager, where the confusion cannot arise and the larger alphabet is strictly better.
Related categories
Encoding & Escaping
Escape, unescape and encode text and structured data — JSON string escaping, Base64 and character encoding, all running locally in your browser.
Generators
Generate the assets you would otherwise design by hand — QR codes, icons, gradients — and download them as files. Everything runs in your browser.
Text Tools
Word and character counting, manuscript fee estimates and other text utilities that run entirely in your browser.
This space is reserved for a sponsor. Every tool on this site stays free and runs locally in your browser.