Password Generator
Create strong, random passwords backed by your device’s cryptographic random number generator. Choose a length and character sets, press generate, and copy — nothing ever leaves your browser.
How many characters. 16+ recommended; longer is stronger.
Removes easily confused characters for manual typing.
Tap “Generate password” to see your result.
How it works
Every character comes from crypto.getRandomValues, the cryptographically secure pseudorandom number generator (CSPRNG) built into your browser and Node.js. Unlike Math.random — whose predictable sequences are fine for games and animations but worthless for secrets — a CSPRNG draws from your operating system’s entropy pool, so the next character stays unguessable even after an attacker has seen every previous one. Randomness quality matters more than most people realize. The common shortcut — taking a random 32-bit integer modulo the pool size — silently skews results whenever the pool size does not divide evenly into 2³², making some characters measurably likelier than others. This tool uses rejection sampling instead: any raw value falling in the biased remainder range is discarded and redrawn, so every character in your selected pool is exactly equally likely. Strength is measured in entropy bits: length × log₂(pool size). A 16-character password drawn from a 96-character pool carries roughly 105 bits — far beyond any realistic brute-force effort. The Entropy (bits) output updates with your settings, so you can see precisely what each choice costs, including the tiny price of excluding look-alike characters such as l, 1, I, O and 0. Honest guidance: a reputable password manager plus a unique generated password for every site beats any memorization trick. Generation happens entirely on your device — nothing is transmitted, logged, or stored — but treat any password as exposed once you have copied and pasted it on a shared or monitored machine.
Frequently asked questions
Are these passwords safe to use?
Yes. Every password is generated locally in your browser with its built-in cryptographic engine — nothing is sent to a server, logged, or stored. One caveat: treat any password as exposed once you have copied and pasted it on a shared or monitored machine.
How long should my password be?
Sixteen characters or more suits most accounts. Twenty or more is wise for master accounts — your email or banking login — where whoever controls them controls everything else. Longer always wins: each extra character multiplies an attacker’s work.
Why exclude look-alike characters?
Characters like l, 1, I, O and 0 are easy to misread when you type a password by hand. Excluding them shrinks the pool slightly, costing a fraction of a bit per character — the Entropy (bits) output shows the exact difference so you can decide.
Is Math.random weaker than crypto randomness?
Yes. Math.random produces predictable sequences meant for animations and games, not secrets — its output can be reconstructed from a few observed values. This tool uses crypto.getRandomValues, which draws from your operating system’s entropy pool and is designed to resist prediction.