Password Generator
Create strong, random passwords using your browser's cryptographically secure generator.
Security Protocol
**Web Crypto API**: Utilizing hardware-backed entropy generators for verifiable randomness.
**Zero-Knowledge**: Calculations occur in isolated RAM. No keys ever touch the cloud.
Generate a strong, random password to your own specification: set the length, and choose whether to mix in uppercase letters, numbers and symbols. Crucially, the randomness comes from your browser's cryptographically secure generator — not the ordinary Math.random() that many toy tools rely on — so the passwords are genuinely suitable for real accounts. Nothing you generate is transmitted; it all happens on your device.
Why the source of randomness matters
A password is only as unpredictable as the randomness behind it. This generator uses crypto.getRandomValues(), the browser's cryptographically secure random number generator, to pick each character. That's a meaningful distinction: Math.random() is fast but predictable enough that its output should never be used for anything security-related. Because the values here are drawn from the secure source, an attacker can't reconstruct the sequence, and every password you generate is independent of the last.
Choosing length and character sets
Length is the single biggest lever on strength — each extra character multiplies the number of possibilities far more than swapping one character type for another. Lowercase letters are always included; the checkboxes add uppercase, numbers and symbols on top. Turning all of them on gives the widest character pool and the strongest result. The strength indicator gives you an at-a-glance sense of how the current settings compare, but as a rule of thumb, favour more length over fewer character types when a site imposes limits.
Using generated passwords safely
A random password is only useful if you don't have to remember it, so pair this with a password manager: generate, copy, and let the manager store it. Use a different password for every account — reuse is what turns one breach into many. And because these passwords are effectively impossible to memorise, never rely on recalling them; that's the trade-off for the strength that randomness buys you.
Frequently Asked Questions
Are these passwords actually secure enough to use?
Yes. They are generated with crypto.getRandomValues(), the browser's cryptographically secure random number generator, which is appropriate for real passwords — unlike Math.random(), which is predictable and should not be used for security.
Is my password sent to a server?
No. Generation happens entirely in your browser. Nothing is uploaded, logged, or stored anywhere — close the tab and it is gone.
What length should I choose?
Longer is stronger. Length adds far more strength than character variety, so when a site limits which characters you can use, compensate by making the password longer.
Lowercase letters seem to always be included — why?
Lowercase forms the base character set so a password is never empty of letters. The checkboxes then add uppercase, numbers and symbols on top to widen the pool.
How should I store a password I cannot remember?
Use a password manager. Generate the password, copy it, and let the manager save it — that lets you use a unique, strong password for every account without memorising any of them.