Password Generator

Generate cryptographically secure passwords using the Web Crypto API — browser only, nothing sent to a server

—
—
Settings
20
Bulk Generate

What is Password Generator?

Password Generator creates cryptographically random passwords of any length with full control over which character classes to include: uppercase letters, lowercase letters, digits, and symbols. It uses the browser's crypto.getRandomValues() API — the same entropy source used by operating systems for security-sensitive randomness — so the output is suitable for real passwords, not just demonstrations.

A weak password is one of the most common causes of account compromise. Dictionary attacks and credential stuffing attacks exploit predictable patterns — names, words, keyboard walks like "qwerty123", or simple substitutions like "P@ssw0rd". A truly random 16-character password from a 94-character alphabet has approximately 105 bits of entropy, which would take billions of years to brute-force even with specialized hardware.

This tool is useful whenever you need a strong password for a new account, a service API key placeholder, a database password, an encryption passphrase, or a temporary secret for testing. The generated password is never transmitted anywhere — everything runs locally in your browser tab.

If you need a memorable passphrase instead of a random string, consider a diceware-style generator. For passwords that must be typed by hand frequently, increase length and reduce symbols rather than shortening the password.

How to Use

  1. Set the desired password length using the slider or number input (8–128 characters recommended).
  2. Check or uncheck character classes: uppercase (A–Z), lowercase (a–z), digits (0–9), symbols (!@#$%^&*…).
  3. Click Generate to produce a new random password.
  4. Click the copy icon or the password field to copy it to your clipboard.
  5. Click Generate again at any time to get a completely different password.

Examples

Length: 16, all character classes

→ Example output: mK7!vQp2#nLd8Rx& — 16 characters, high entropy, suitable for most web accounts

Length: 24, no symbols (alphanumeric only)

→ Example output: 4fBmQv9LkPzNsR2wTgYc3DhA — safe for systems that reject special characters

Length: 32, lowercase and digits only

→ Example output: 7k2m9q4v1p8n3r6w5t0y2s4d8h1j — for systems with strict character set restrictions

Frequently Asked Questions

Is crypto.getRandomValues truly random?

Yes. It uses the operating system's cryptographically secure pseudorandom number generator (CSPRNG) — the same source used by TLS, SSH key generation, and OS-level secrets. It is not predictable from prior outputs.

How long should my password be?

For most web accounts, 16 characters with mixed character classes gives ample security today. For long-lived secrets like master passwords or encryption keys, 24–32 characters is a safer baseline.

Should I include symbols?

Symbols increase the character set from 62 to 94, adding about 0.7 bits per character. For a 16-character password that's roughly 11 extra bits — meaningful but not critical if the site enforces account lockout. Omit symbols only when the system rejects them.

Is the generated password stored anywhere?

No. The password exists only in your browser's memory and your clipboard. This page makes no network requests after it loads.

Can I generate multiple passwords at once?

The generator produces one password per click. For bulk generation (e.g., seeding a test database), consider using your terminal: openssl rand -base64 24 generates one per invocation; wrap it in a loop for batches.

Related Tools