Password Generator
Runs entirely in your browser
Create a strong, random password directly in your browser. Nothing you generate is ever sent to a server or stored.
How to use Password Generator
- Adjust the length slider and choose which character types to include.
- A new password generates automatically — click Generate New Password for another.
- Click Copy to copy it to your clipboard.
Features
- Cryptographically secure randomness via the Web Crypto API.
- Adjustable length from 4 to 64 characters.
- Toggle uppercase, lowercase, numbers and symbols independently.
- Optional exclusion of visually ambiguous characters.
- Simple strength indicator.
- One-click copy to clipboard.
- 100% client-side — passwords are never sent to a server or stored.
Tips for stronger passwords
- Character selection uses rejection sampling on a 32-bit value from
crypto.getRandomValues()rather than a plain modulo — this specifically avoids "modulo bias," a subtle flaw where naive random-index math makes some characters very slightly more likely than others. - With all four character types on, the pool is 89 characters (26 uppercase + 26 lowercase + 10 digits + 27 symbols). A 16-character password from that pool has roughly 103 bits of entropy — versus around 71 bits for a 12-character password using only letters and digits (62 characters). Longer length matters more than adding one more character type.
- At least one character from every ticked type is guaranteed to appear, then the whole password is shuffled with a Fisher–Yates algorithm using the same secure random source — so required characters don't cluster near the start, which is a common weakness in simpler generators.
- "Exclude ambiguous characters" removes exactly five characters —
1,l,I,O,0— useful if you'll ever need to type or read the password aloud, but it slightly shrinks the pool and therefore the entropy for a given length.
Is Password Generator safe?
Yes. Every password is generated locally using crypto.getRandomValues() and the rejection-sampling and Fisher–Yates shuffling described above — nothing is transmitted, logged or stored anywhere, not even by us, and no account is required.
Frequently Asked Questions
Is this password generator secure?
Yes. It uses your browser's Web Crypto API (crypto.getRandomValues) for cryptographically secure randomness, rather than a predictable source like Math.random().
What does "Exclude ambiguous characters" do?
It removes characters that can be confused with each other when read or typed, such as lowercase l, uppercase I, uppercase O and the digits 0 and 1.
How long should my password be?
Most security guidance recommends at least 12–16 characters using a mix of uppercase, lowercase, numbers and symbols. Longer passwords with more character types are harder to guess or crack.