Secure Password Generator
Generate cryptographically random passwords using your browser's secure crypto.getRandomValues() API - configurable length and character sets.
Configure length and character sets - this generator uses your browser's cryptographically secure random number generator, never Math.random().
Generated using crypto.getRandomValues(), your browser's cryptographically secure random source - never Math.random(). Nothing generated here is sent to or stored on any server.
More Security & Authentication Tools
View all 14Nothing you generate here is ever sent anywhere or stored - the password exists only in your browser until you copy it.
Why Randomness Quality Matters
Not all "random" is equal - JavaScript's Math.random() is not cryptographically secure and can be predictable. This tool uses crypto.getRandomValues(), the Web Crypto API's cryptographically secure random source, the same quality of randomness used for real security-sensitive operations.
How to Use It
- Set your desired password length.
- Toggle which character sets to include: uppercase, lowercase, numbers, symbols.
- Click Generate - a new password is created using secure randomness.
- Copy it directly; nothing is stored or transmitted.
Choosing a Good Length
Longer passwords are dramatically stronger against brute-force attacks than adding complexity to a short one - a 16+ character password with a decent character set is generally far stronger than an 8-character one with every symbol type enabled.
Limitations
This generates a random string - it cannot know if a particular website's password policy has unusual requirements (like disallowing certain symbols). Adjust your character set selections if a site rejects the generated password.
How Strong Is a Generated Password?
| Length and characters | Approximate entropy | Good for |
|---|---|---|
| 12 characters, letters + digits | ~71 bits | Low-value accounts |
| 16 characters, all character sets | ~105 bits | Most accounts |
| 20+ characters, all character sets | ~130 bits | Email, banking, admin panels |
| 32+ characters | ~210 bits | API keys, service passwords, secrets |
Each bit doubles the number of guesses an attacker needs; above about 80 bits, guessing is not a realistic attack for a password that is stored properly.
Tips
- Store it in a password manager - a random 20-character password is only practical if you never have to type it from memory.
- Turn symbols off for systems that reject them, and add length instead.
- Generate a new one for every site; reuse is how one breach becomes many.
- For passwords you must type often, such as a laptop login, use a long passphrase of random words.
Check any password with the Password Strength Checker, see the maths with the Password Entropy Calculator, and read how to create a strong password.
Frequently Asked Questions
Explore More Tools
Keep going with related categories and our most used tools.