Password Generator

Create strong random passwords with custom length and characters.

🔒 Passwords are generated with your browser's cryptographic random generator and never leave your device.

What Does the Password Generator Do?

This generator creates strong random passwords using your browser's cryptographically secure random number generator — the same quality of randomness used for encryption keys. Set the length (6–64 characters), toggle lowercase, uppercase, numbers and symbols, optionally exclude look-alike characters (l, 1, I, O, 0) for passwords you might read aloud or type from paper, and generate single passwords or bulk lists up to 100 at once. A strength bar rates every result live.

Nothing leaves your device. Generation happens locally in JavaScript; no password is ever transmitted, stored or logged.

How to Generate a Password

  1. Set the length — 16 is a strong default; 20+ for critical accounts.
  2. Choose character sets (all four enabled gives maximum strength per character).
  3. Click Copy to grab the password, or 🎲 Regenerate for a new one.
  4. Need many? Enter a count and click Generate List.

Password Hygiene That Actually Matters

  • One account, one password — uniqueness stops a single breach from cascading across your accounts.
  • Use a password manager — generate long random passwords freely because nothing needs memorizing.
  • Guaranteed variety — the generator includes at least one character from every set you enable, then shuffles cryptographically, so no "all lowercase by chance" surprises.
  • Add 2FA — even a perfect password is stronger with a second factor behind it.

Frequently Asked Questions

How random are these passwords really?

They use crypto.getRandomValues — the browser's cryptographically secure generator — with unbiased rejection sampling and a crypto-shuffled layout. This is production-grade randomness, not Math.random().

What length should I choose?

16 characters with all character sets is strong for general accounts (~100 bits of entropy). Use 20+ for email, banking and password-manager master passwords. Below 12 is not recommended for anything that matters.

Why exclude look-alike characters?

In many fonts l/1/I and O/0 are nearly identical — a problem for passwords read from paper or spoken aloud (WiFi keys, printed credentials). Excluding them costs a little entropy; add length to compensate.

Can generated passwords be recovered later?

No — nothing is stored anywhere. Copy the password into a password manager immediately; once you leave the page it is gone for good.