Password Generator

What the Password Generator does

Set the length anywhere from 4 to 64 (it starts at 16), tick the character sets you want and a password appears. Click it to copy, or press Generate for a new one. A small strength read-out underneath shows how length and variety change the result.

You can trust the result because of where the randomness comes from. The tool uses crypto.getRandomValues, the same secure generator browsers use for encryption keys. Many simpler tools use Math.random, whose output is predictable and unsafe for secrets.

How it works

The tool builds a character pool from the boxes you tick (26 uppercase, 26 lowercase, 10 digits and 26 symbols), then fills each position by drawing a random number from the Web Crypto generator and mapping it onto that pool.

The strength label, from Very weak to Very strong, is a quick estimate based on the password's length and how many character classes it uses. Everything happens in the page and the password is never sent. Pressing Generate draws a new set of random numbers.

Generation algorithm

The randomness comes from crypto.getRandomValues, the browser's cryptographically secure generator, which is seeded by the operating system and also used for encryption keys. The tool does not use Math.random, which is predictable and should never be used for secrets.

1. Step 1. Build the character pool from the sets you enable (uppercase 26, lowercase 26, digits 10, symbols 26).
2. Step 2. For each of the N positions, draw a random value from the Web Crypto generator.
3. Step 3. Map that value onto the pool and take the character at that index.
4. Step 4. Show the finished password with a quick strength read-out based on length and variety.
5. Step 5. Press Generate for a new one, or click the password to copy it.

Password entropy

These entropy figures apply in full because the tool picks every character at random. Each extra bit doubles the number of guesses an attacker needs.

Privacy

The password is generated on your device and never transmitted. Generating it makes no network request at all.

Nothing is saved, and refreshing the page clears it. Copy it straight into your password manager.

No server is involved, so no log of what you generated exists anywhere.

Technical details

Standards and references

• NIST SP 800-63B: current US guidance: prefer length over complexity, require at least 15 characters for a password used on its own, allow at least 64, and don't force composition rules.
• Web Crypto: getRandomValues: the browser API for cryptographically secure random values. This tool uses it for every character.
• Entropy (bits): the standard measure of unpredictability, length × log2(pool). Each bit doubles the guesses required.

Accuracy and limits

The strength label is a quick estimate from length and character classes, not a full audit. A 16-character random password from this tool is strong whatever label it shows.

The entropy figures assume you keep the first result. If you keep regenerating until one 'looks nicer', you are choosing among them, and that lowers the randomness. Use the one it gives you.

A generated password is only as safe as where you keep it. Store it in a password manager, not in a note, email or spreadsheet.

Mapping a 32-bit random number onto the character pool introduces a tiny modulo bias. At these pool sizes it makes no practical difference, but the tool doesn't claim perfect uniformity.

Real-world uses

When it fits, and when it doesn't

To remember a password without a manager, use the passphrase generator. For digits only, use the PIN generator. To grade a password you already have, use the password strength checker.

Tips and tricks

What we would do

Frequently asked questions

References

• NIST SP 800-63B — Digital Identity Guidelines (NIST)
• Crypto.getRandomValues() (MDN)
• Math.random() — not for security (MDN)
• Password strength & entropy (Wikipedia)

Related tools