Random Password Generator
Generate strong, random passwords using your browser's built-in cryptographic random number generator. Nothing is ever sent anywhere.
How to use this tool
A password is generated automatically as soon as the page loads. Adjust the length and character-set options, and a new password generates instantly — or press "Generate new" any time for a fresh one with the current settings. Press "Copy" to copy it to your clipboard.
About this generator
This tool uses crypto.getRandomValues() — the Web Crypto API's cryptographically secure random number generator built into every modern browser — rather than Math.random(), which is fast but not safe for generating secrets. Each character is chosen using rejection sampling: random bytes that would introduce bias (because the character set size isn't a power of two) are discarded and re-drawn, so every allowed character has an exactly equal probability of being chosen.
Generation happens 100% client-side. No password is ever transmitted, logged, or stored by this site.
Frequently asked questions
Is this password generator secure?
Yes. It uses the Web Crypto API's crypto.getRandomValues(), a cryptographically secure random number generator built into your browser — not Math.random(), which is not safe for security purposes. Character selection uses rejection sampling to avoid modulo bias, so every character in the chosen set has an equal chance of appearing.
Are passwords sent to a server?
No. Password generation happens entirely in your browser using JavaScript. Nothing is transmitted, logged, or stored anywhere — closing or reloading the page discards it completely.
How long should my password be?
Most current guidance recommends at least 12-16 characters with a mix of character types for important accounts, and longer (20+) for highly sensitive accounts or master passwords. Length matters more than complexity for resisting brute-force attacks.
What does the strength estimate mean?
It shows the password's entropy in bits, calculated as length × log2(character set size) — a measure of how many guesses a brute-force attacker would need on average. Higher is stronger; 60+ bits is generally considered strong for most purposes.