Secure Password Generator
Generate passwords from your browser's cryptographic random source. Nothing is sent anywhere, nothing is logged, and the entropy figure tells you how strong the result actually is.
Real randomness, not `Math.random`
Every character comes from `crypto.getRandomValues`, the browser's cryptographically secure generator, drawn with rejection sampling so the distribution stays uniform. `Math.random` is predictable enough that passwords built from it have been recovered in practice - it has no place here.
Length beats complexity
The entropy figure shown with each batch is the honest measure of strength: length multiplied by the bits each character contributes. Adding four characters helps far more than adding a symbol requirement. Aim for 60 bits or more for ordinary accounts, and 80 or more for anything that protects other credentials.
Ambiguous characters, and when to keep them
Excluding `l`, `I`, `O`, `0` and `1` avoids transcription mistakes when a password has to be typed from a screen or read aloud. Keep them when the password only ever moves between a password manager and a login form, since every excluded character shrinks the alphabet slightly.
Frequently asked questions
Is the password generated on your server?
No, and this is the whole point. Nothing you paste leaves your browser. The page loads a small amount of JavaScript, and every calculation happens on your own machine - there is no server to send data to. A password generator that runs on a server has, by construction, seen your password. This one cannot: the page has no network calls after it loads, and you can verify that in your browser's network tab.
How long should a password be?
Twenty characters from a mixed alphabet is a sensible default and gives well over 100 bits of entropy. The practical limit is what the site accepts - some still cap at 16 or reject symbols. When a site imposes a short maximum, that is a sign about its security practices worth noting.
Should I use a password manager?
Yes. Unique random passwords are only workable if something remembers them for you. Generate directly in your manager where possible; use a tool like this one when you need a password outside it, and store the result immediately.
What about passphrases instead?
Several random words are easier to type and remember and can be just as strong, provided the words are chosen randomly from a large list rather than picked by a person. For anything you must type by hand regularly, a passphrase is often the better choice.