Password Generator

Generate strong passwords with uppercase, lowercase, digits and symbols. Exclude ambiguous characters. Bulk generation. Uses crypto.getRandomValues for maximum entropy.

How Password Generator works

Password Generator creates cryptographically random passwords using the browser's crypto.getRandomValues API, which draws from the operating system's entropy pool. Unlike simple Math.random-based generators, crypto.getRandomValues is a cryptographically secure pseudo-random number generator (CSPRNG) recommended for security-sensitive applications. Nothing you configure or generate is sent anywhere; the entire process runs on your device.

You control which character sets to include: uppercase letters, lowercase letters, digits, and a configurable set of symbols. You also set the length. The tool shows an estimated entropy (in bits) for each configuration so you can judge the strength of your choices. A 16-character password using all four character classes typically yields around 95 bits of entropy, which exceeds the threshold recommended by NIST for high-value accounts.

Written by Bastien Sulyan

How to use Password Generator, step by step

Set the desired password length using the length slider or input field.
Toggle which character classes to include: uppercase, lowercase, digits, and symbols.
Optionally customise the symbol set if you need to exclude characters that cause issues in certain input fields.
Click 'Generate' (or the refresh icon) to create a new password.
Click the copy button to copy the generated password to your clipboard.

Common use cases

A user creating a new account on a service needs a strong, unique password that they will store in their password manager.
A sysadmin provisioning a new service account needs a random password that meets a policy requiring uppercase, lowercase, digits, and symbols.
A developer testing a form's password strength meter needs random passwords of varying complexity to confirm the meter's thresholds are correct.
A small business owner creating guest Wi-Fi credentials wants a memorable-length password that is still random enough to resist guessing.

Frequently asked questions

Is the random number generator used here truly random?

crypto.getRandomValues is a CSPRNG (cryptographically secure pseudo-random number generator). It seeds from the operating system's entropy sources (hardware events, timer jitter, and similar) and produces output that is computationally indistinguishable from truly random bytes. It is suitable for generating passwords, tokens, and keys. Batch mode draws fresh randomness for each password in the list, so none of them is derived from another.

Is it safe to use an online password generator?

Yes, this one specifically: the password is generated entirely in the browser's JavaScript engine using crypto.getRandomValues and shown in the UI. It is never written to any database, analytics system, or server, and closing the tab clears it from memory. Be more cautious with generators that create the password server-side and send it back to you: that copy could be logged along the way, which defeats the point of a random password.

What does 'entropy in bits' mean for a password?

Entropy is a measure of unpredictability. For a password drawn uniformly at random from a character pool of size N, each character adds log2(N) bits of entropy. A 16-character password from a 94-character printable ASCII set has 16 * log2(94) approximately 104.9 bits of entropy. Higher entropy means more guessing attempts are required to find the password by brute force.

Should I include symbols in every password?

Symbols increase the character pool size, which raises entropy per character. However, some systems reject certain symbols (semicolons, quotes, angle brackets) in password fields. The tool lets you customise the symbol set so you can remove problematic characters while keeping the rest.

Can I generate passphrases (word-based passwords) with this tool?

This tool generates character-based random passwords. For word-based passphrases (such as the Diceware method), you would need a separate tool that draws from a word list. Character-based passwords of 16 characters or more from a full character set provide comparable or greater entropy to most four-word passphrases.

Do I need an account to generate a password, and does it work on my phone?

No account, no sign-up. crypto.getRandomValues is available in mobile Chrome and Safari as well as desktop browsers, so generating a strong password while setting up an account on your phone works exactly the same way.

Related tools

Keep everything local, explore complementary tools.

All developer tools