Password Generator
Generate strong passwords. Custom length and charset, pronounceable mode available.
SecureRandomClient-sideFree to use
Length16
Count1
~103 bits of entropy
How to use
- Pick length. 8–64 characters.
- Pick charset. Uppercase, lowercase, numbers, symbols.
- Click Generate. Click again for a new one.
Common use cases
- Creating account passwords
- Seeding API keys
- Generating temporary credentials
Frequently asked questions
- Are these passwords cryptographically secure?
- Yes. Each character is drawn from crypto.getRandomValues, the browser native CSPRNG used in security-sensitive applications. Predictable Math.random is never used.
- How long should my password be?
- Minimum 12 characters for general accounts; 16 or more for important accounts (email, banking, password manager master password). With the full character set, 16 chars gives roughly 105 bits of entropy, which is uncrackable by brute force.
- What is the No ambiguous chars option?
- It removes characters that look alike in many fonts: uppercase O and zero (0), lowercase L and uppercase I and the digit 1. Useful when a password will be read aloud, printed, or transcribed by hand.
- When should I use Pronounceable mode?
- Use it for temporary passwords or one-time codes that someone needs to read or remember briefly. Pronounceable passwords have lower entropy than fully random ones, so do not use them for long-lived account passwords.
- What about Passphrase mode?
- Passphrase mode picks several random words from a wordlist (the diceware approach). A 4-word passphrase has roughly 50 bits of entropy and is much easier to remember and type than a random string of the same strength.
- Is anything sent to a server?
- No. Generation is fully local. Passwords are not logged, transmitted, or stored anywhere; close the tab and they are gone.
Related tools
How to use
- Pick length. 8–64 characters.
- Pick charset. Uppercase, lowercase, numbers, symbols.
- Click Generate. Click again for a new one.
Common use cases
- Creating account passwords
- Seeding API keys
- Generating temporary credentials
Frequently asked questions
- Are these passwords cryptographically secure?
- Yes. Each character is drawn from crypto.getRandomValues, the browser native CSPRNG used in security-sensitive applications. Predictable Math.random is never used.
- How long should my password be?
- Minimum 12 characters for general accounts; 16 or more for important accounts (email, banking, password manager master password). With the full character set, 16 chars gives roughly 105 bits of entropy, which is uncrackable by brute force.
- What is the No ambiguous chars option?
- It removes characters that look alike in many fonts: uppercase O and zero (0), lowercase L and uppercase I and the digit 1. Useful when a password will be read aloud, printed, or transcribed by hand.
- When should I use Pronounceable mode?
- Use it for temporary passwords or one-time codes that someone needs to read or remember briefly. Pronounceable passwords have lower entropy than fully random ones, so do not use them for long-lived account passwords.
- What about Passphrase mode?
- Passphrase mode picks several random words from a wordlist (the diceware approach). A 4-word passphrase has roughly 50 bits of entropy and is much easier to remember and type than a random string of the same strength.
- Is anything sent to a server?
- No. Generation is fully local. Passwords are not logged, transmitted, or stored anywhere; close the tab and they are gone.