Security & Privacy / Security Tools

Password Generator

A password generator builds a random credential from a character set you choose — length plus letters, digits and symbols — using the browser's crypto.getRandomValues so the result is unpredictable. Because the generation runs entirely on your device, the password never touches a server and is not saved anywhere. NIST SP 800-63B recommends a minimum of 8 characters, but longer passphrases made of more character types are far harder to guess or brute-force.

How to use

1
Set the length
Drag the length slider or type a number. Anything from 4 to 128 characters is allowed; 12-16 is a good everyday choice and longer is better for high-value accounts.
2
Pick character types
Tick the boxes for lowercase, uppercase, digits and symbols. Leave at least one on — if you turn them all off the tool falls back to letters and digits so it can still produce a password.
3
Exclude look-alikes (optional)
Switch on Exclude ambiguous characters to drop 0 O 1 l I | 5 S 2 Z 8 B. Use this when the password will be read or typed by hand; leave it off when it is only ever copied.
4
Generate
Press Generate password. The strength bar updates live as you change options, showing the estimated entropy in bits and a Weak / Medium / Strong / Very strong rating.
5
Copy or generate many
Copy a single password with its Copy button, or set How many to generate to produce a batch and copy them all at once. Every value is created locally and never leaves the page.

Key facts

Web Crypto randomnessPasswords here are generated with the browser's Web Crypto API, specifically crypto.getRandomValues, which draws from the operating system's cryptographic random source. That makes the output unpredictable, unlike the pseudo-random numbers returned by ordinary math functions.Source:W3C Web Crypto API; MDN crypto.getRandomValues
NIST length guidanceNIST SP 800-63B recommends a minimum length of 8 characters for user-chosen secrets and discourages arbitrary composition rules (forcing symbols, periodic changes) in favour of length and screening against known-breached passwords. Longer passphrases from a larger character set resist brute-force far better.Source:NIST SP 800-63B

Frequently asked questions

Are the passwords generated here saved anywhere?

No. The password is produced inside your browser tab using crypto.getRandomValues and is held only in the page's memory while it is open. It is never written to a server, never stored in a database, and never sent over the network — close the tab and it is gone. If you need to keep a password, copy it and store it in a password manager you trust.

What makes a password strong?

Strength comes mostly from length and from mixing character types. Each extra character multiplies the number of possibilities, and adding uppercase, digits and symbols widens the alphabet an attacker must try. This tool estimates strength as entropy in bits: roughly below 40 bits is weak, 40-69 is medium, 70-127 is strong, and 128 or more is very strong. A 16-character password using all four types lands around 100 bits, which is far beyond what brute force can reach.

How should I store my passwords safely?

Use a dedicated password manager rather than reusing one password across sites or writing passwords in a note. A manager encrypts a unique, random password for every account, so a leak at one service cannot unlock the others. Enable two-factor authentication on important accounts, and keep the manager's master password long and memorable but not based on dictionary words.

Is the randomness cryptographically secure?

Yes. Generation uses the Web Crypto API's crypto.getRandomValues, the same primitive browsers expose for security-sensitive work. It draws from the operating system's cryptographic random source, so the output is unpredictable and not the weaker pseudo-random number generator used by ordinary math functions.

Why exclude ambiguous characters?

Some characters look alike across fonts — 0 and O, 1 and l and I, 5 and S, 2 and Z, 8 and B, and the vertical bar. When you must read or type a password by hand, excluding these avoids mistakes. Turn the option off when the password is only ever pasted from the manager and never typed, to keep the character set as large as possible.

Related tools

WiFi QR Code Generator

Turn a network name and password into a scannable WiFi QR code. Pick WPA, WPA2, WEP or an open network, then download a PNG or SVG.

CSS Gradient Generator

Build a CSS linear or radial gradient visually: place colour stops, set the angle, alpha and position, then copy the CSS or a Tailwind class.

Favicon Generator

Generate a favicon.ico plus 16, 32, 64 and 128 px PNG icons from a letter, initials or an image. Preview them in a real browser tab, then download the set.