Password Generator

🔒 Processed 100% in your browser — nothing is uploaded

About this tool

Reused or predictable passwords are still the number-one cause of account breaches, and the fix is boring: a unique random password per account. This generator creates cryptographically strong passwords using your browser's CSPRNG — the same crypto.getRandomValues that security products rely on — never the predictable Math.random. Choose a length from 8 to 128 characters, toggle uppercase, lowercase, digits and symbols, and optionally exclude ambiguous characters like O and 0 or l and 1 so passwords survive being read aloud or typed from a printout. Need credentials for a whole team? Batch mode produces up to a hundred passwords at once, ready to copy into an onboarding sheet. A strength meter estimates entropy in bits so you can see exactly what length and alphabet buy you. Everything happens offline in your browser: no password candidate is ever transmitted, logged or stored, which is the only acceptable property for a password generator. Pair it with a password manager and credential hygiene becomes effortless.

How to use Password Generator

  1. Set the desired length and toggle the character sets you want.
  2. Optionally exclude ambiguous characters for readability.
  3. Press Generate to create a password, or set a batch count for many at once.
  4. Copy the password with one click and store it in your password manager.

Frequently asked questions

How random are the passwords?

They use crypto.getRandomValues, the browser's cryptographically secure random source — the same class of generator used by security software.

Are generated passwords sent anywhere?

No. Generation happens entirely offline in your browser. Nothing is transmitted, logged or stored.

What does the entropy number mean?

Entropy in bits measures guessing difficulty: each extra bit doubles the work. 80+ bits is considered strong for most purposes.

Why exclude ambiguous characters?

Characters like O, 0, l and 1 are easily confused when read aloud or transcribed, causing login failures without adding real security.