Password Generator
Create strong, unpredictable passwords with custom length and character sets. Generated locally in your browser using the Web Crypto API.
Click Generate below to create a secure password.
Character rules
crypto.getRandomValues). Passwords are never sent over the network.Introduction
Weak and reused passwords are the leading cause of account compromises. A strong password must be long, unpredictable, and unique to each service you use. This password generator creates high-entropy passwords entirely on your device using your browser's native cryptographic random number generator.
How to use this password generator
- Choose length: Adjust the slider or type a length between 8 and 128 characters. 16 or more characters is recommended for general online accounts.
- Select character rules: Toggle uppercase letters (A–Z), lowercase letters (a–z), numbers (0–9), and symbols (!@#$%).
- Generate & copy: Click Generate password or Generate again, then copy the result with one click.
Why Web Crypto instead of Math.random()?
Standard JavaScript Math.random() is a pseudo-random number generator (PRNG) designed for speed, not security. Its internal state can be determined after observing a small sequence of outputs, making it unsuitable for generating credentials.
This tool exclusively uses the W3C crypto.getRandomValues() API, which draws entropy from your operating system's cryptographic random pool (such as /dev/urandom on Unix or CryptGenRandom on Windows). Character selection also employs rejection sampling to eliminate modulo bias, ensuring every character in the chosen set has an equal probability of appearing.
Password security best practices
- Prioritize length: A 16-character password with letters and numbers has vastly higher entropy than an 8-character password with complex symbols.
- Never reuse passwords: If one website suffers a data breach, credential stuffing attacks will attempt to use that same combination across other platforms.
- Use a password manager: Password managers securely store and autofill complex, unique passwords so you only need to remember one master passphrase.
- Enable Multi-Factor Authentication (MFA): Whenever available, enable two-factor or multi-factor authentication (such as authenticator apps or hardware keys) for critical accounts.
Frequently Asked Questions
Are my generated passwords sent to any server?
No. All password generation happens 100% locally inside your browser via JavaScript. No network requests are made, and no passwords are ever stored, logged, or transmitted.
What length should my password be?
We recommend at least 16 characters for typical online accounts, and 20+ characters for critical accounts like email, password managers, and financial services.
What does the password strength indicator mean?
The strength indicator estimates theoretical entropy based on character set variety and length. It serves as a visual guide and is not a formal cryptographic certification.