Password Generator
Generate a strong, random password using your browser's cryptographic random number generator — adjust length and character sets, copy, done.
wEAsQC0XhtlGwnWA
Strong · ~95 bits of entropy
How the randomness actually works
This generator uses your browser's Web Crypto API (crypto.getRandomValues) rather than Math.random() — the former is a cryptographically secure random source suitable for generating secrets; the latter is not, and using it for passwords is a real (if commonly overlooked) weakness. Character selection also uses rejection sampling to pick each character, which avoids the subtle bias that a naive "random number modulo alphabet size" approach introduces.
Every character set toggle you turn on gets combined into one pool that each character of the password is drawn from independently and uniformly — turning on more sets increases both the pool size and the password's entropy (the bits shown below the password), which is the actual measure of how hard it is to brute-force. Length matters more than character variety: a 20-character lowercase-only password is stronger than a 10-character password using every character set.
Frequently asked questions
Is this actually secure, or just for show?
It's genuinely secure: passwords are generated with the Web Crypto API's cryptographically secure random number generator, the same class of randomness used for encryption keys, not a simple pseudo-random function. Nothing about the process is simulated for appearance.
Does the password ever leave my browser?
No. Generation, the strength calculation, and the copy button all run entirely client-side — nothing is sent to a server, logged, or stored anywhere. Refreshing the page clears it for good.
What does the entropy number actually mean?
It's the number of bits of randomness in the password — each additional bit doubles the number of guesses an attacker would need on average. Above about 80 bits, a password is far beyond what's practically crackable by brute force with current technology.