About the Password Generator
This generator creates strong, unpredictable passwords entirely in your browser using the Web Crypto API's cryptographically secure random number generator. You control the length, which character classes are included, and whether visually ambiguous characters are excluded, then generate one or several passwords at once.
How to use it
- 01Set the desired password length using the slider (8 to 128 characters).
- 02Toggle which character classes to include: lowercase, uppercase, digits, and symbols.
- 03Optionally exclude ambiguous characters like I, l, 1, O and 0 to make passwords easier to read and type.
- 04Choose how many passwords to generate at once (up to 10).
- 05Click Generate, then copy any password you want to use.
Features
- Uses crypto.getRandomValues with rejection sampling for unbiased randomness.
- Guarantees at least one character from every selected class.
- Live entropy estimate in bits with a plain-language strength label.
- Generates up to 10 passwords in a single batch.
- One-click copy per generated password.
Practical examples
Everyday account password
Enable all four character classes at length 16-20 for a strong, general-purpose password suitable for most online accounts.
Manually typed password
Enable exclude-ambiguous when a password must be typed by hand or read aloud, to avoid confusing similar-looking characters.
Limitations
- Entropy is estimated from pool size and length; it assumes a uniformly random selection and does not account for site-specific password rules.
- This tool does not check passwords against breach databases.
- Very short lengths combined with few character classes produce weak passwords regardless of randomness quality.
Privacy
All password generation happens locally in your browser using the Web Crypto API. Passwords are never sent to a server, logged, or stored in localStorage — closing or refreshing the page discards them permanently.
Read the full privacy policy for how the site as a whole handles data.
Frequently asked questions
Is Math.random used anywhere?
No. All randomness comes from crypto.getRandomValues with rejection sampling to avoid modulo bias.
Are my generated passwords stored?
No. Passwords exist only in the page's memory while it is open and are discarded on refresh or navigation.
What does the entropy number mean?
It's an estimate of unpredictability in bits, based on the character pool size and length. Higher is harder to guess by brute force.
Why require one of each selected class?
Some systems reject passwords lacking a required character class; guaranteeing inclusion avoids that failure mode without weakening randomness elsewhere.