Password Generator
Generate strong, random passwords with custom length and character rules, instantly inside your browser.
What makes a password strong?
A strong password is long, unpredictable, and drawn from a large pool of possible characters — mixing uppercase and lowercase letters, numbers, and symbols makes it far harder to guess or brute-force than a short word or a predictable pattern. Length matters more than complexity: a 16-character password from a mixed character set is dramatically harder to crack than an 8-character one, even with symbols.
This tool generates random passwords using the browser's cryptographically secure random number generator, with full control over length and which character types to include.
GuideHow to use it
How the password is generated
Each character is picked using crypto.getRandomValues — the same cryptographically secure random source browsers use for security-sensitive code — drawing uniformly from the combined pool of the character types you've selected. Turning on "Exclude ambiguous characters" removes visually similar characters like lowercase L, uppercase I, the digit 1, uppercase O, and the digit 0 from the pool, which helps when a password needs to be read or typed manually.
Features & benefits
Why this runs entirely in your browser
A password generated on a server could theoretically be logged or intercepted in transit, so this tool generates every password locally using the Web Crypto API, and nothing is ever sent over the network.
Common uses
Creating a strong password for a new account, generating a passphrase-style secret for an API key or environment variable, or producing a batch of one-off passwords when setting up multiple accounts at once.
Frequently asked questions
A few things people usually want to know before trusting the numbers.
Each character is chosen using crypto.getRandomValues, the browser's cryptographically secure random number source — the same one used for security-sensitive operations, not the weaker Math.random().
16 characters or more is a good default for most accounts. Longer is always stronger, and length matters more than adding extra symbol complexity.
It removes characters that are easy to confuse when read or typed by hand — like lowercase L, uppercase I, the digit 1, uppercase O, and the digit 0.
If every character type toggle is turned off, there's no character pool to generate from — turn at least one type back on.
No. Password generation happens entirely in your browser. Nothing generated here is sent to a server, stored, or shared.