This password generator creates cryptographically random passwords using your browser's built-in security APIs. You control the length, which character types to include, and whether to exclude look-alike characters that cause confusion when typing. Every password is generated locally on your device, so nothing you create here is ever transmitted or stored anywhere.
Enter your values to see the result.
Length 16, all types enabled → k7#mP2$xQ9vL!nR4
A 16-character password with lowercase, uppercase, digits and symbols.
Length 24, no symbols → aB3cD5eF7gH9jK1mN3pQ5rS7
Longer passwords without symbols are still very strong and easier to type.
Length 12, exclude ambiguous → xY4zW6vU8tSr
No O, 0, l, I or 1 — avoids confusion when reading or dictating.
Most people choose passwords that are far too predictable. They use names, dates, dictionary words, or simple patterns like "123456" or "password". Even when they try to be clever, human beings are terrible at randomness: we avoid repeated characters, we favor certain letters, and we create patterns that feel random to us but are obvious to a computer. A password generator removes the human element entirely and produces something that is genuinely unpredictable.
Entropy measures how hard a password is to guess, and it is expressed in bits. A password with n bits of entropy requires, on average, 2 to the power of n guesses to crack by brute force. Each character you add multiplies the search space by the size of the alphabet you are drawing from. A lowercase-only password draws from 26 characters, so each position adds about 4.7 bits of entropy. Add uppercase and you double the alphabet to 52, raising each position to about 5.7 bits. Add digits and symbols and you reach roughly 6.5 bits per position.
The critical insight is that length matters more than alphabet size. A 20-character password using only lowercase letters has about 94 bits of entropy. A 10-character password using every printable ASCII character has about 66 bits. The longer password wins decisively, even though it uses a smaller alphabet, because each additional character multiplies the total search space rather than adding to it.
Many websites enforce complexity rules requiring uppercase, lowercase, digits and symbols. These rules exist because short passwords need every bit of help they can get, but they create a misleading impression that complexity is the primary driver of strength. In reality, a 16-character password made entirely of lowercase letters is stronger than an 8-character password that satisfies every complexity rule a typical website imposes.
This is why security experts increasingly recommend passphrases — long sequences of words — over short, complex passwords. A passphrase like "correct horse battery staple" is easy to remember, easy to type, and very hard to guess, because its length more than compensates for the small alphabet. The password generator on this page lets you choose any approach: short and complex, long and simple, or anywhere in between.
JavaScript provides two random number generators. The first is Math.random, which is fast and suitable for games, simulations, and shuffling a playlist. The second is crypto.getRandomValues, which draws from an operating-system-level entropy pool and is designed for security-sensitive operations like generating passwords, tokens, and encryption keys.
The difference is not subtle. Math.random uses an internal state that can be reconstructed by observing its outputs. Once an attacker knows the state, they can predict every future value, including your passwords. The crypto API uses a fundamentally different source that is designed to remain unpredictable regardless of how many previous outputs an attacker has seen.
This generator uses crypto.getRandomValues exclusively, and it applies rejection sampling to eliminate modulo bias. When you ask for a random index into an alphabet of 26 characters, a naive implementation would take a random 32-bit integer modulo 26. But 2 to the 32nd power is not evenly divisible by 26, so the first few indices would be slightly more likely than the rest. Rejection sampling discards values that would create this bias, ensuring every character has exactly the same probability.
Use at least 16 characters for any account that matters. Use 20 or more for email, banking, and other high-value targets. Store your passwords in a password manager so you do not need to remember them. Enable two-factor authentication wherever possible, so that even if a password is compromised, the attacker still needs a second factor to access your account.
Never reuse passwords across sites. A breach at one service should not compromise your accounts elsewhere. A generator makes this easy: every password is unique, strong, and created in seconds. Copy it, paste it into your password manager, and you are done.
Yes, this generator uses the same cryptographic random number API that browsers provide for security-sensitive operations. The function crypto.getRandomValues is designed to produce unpredictable output suitable for passwords and tokens, and it is available in every modern browser. The implementation also uses rejection sampling to avoid modulo bias, which means every character in the alphabet has exactly the same probability of being selected, with no slight favoritism toward the first few characters.
No, your password is generated entirely within your browser and never leaves your device. The JavaScript code runs locally, uses no network requests, and sends nothing to any server. You can verify this by disconnecting from the internet before generating a password — it will still work perfectly. This is an important security property: a password generator that transmits your passwords over the network would defeat the purpose of having a secure password in the first place.
For most accounts, 16 characters is a strong minimum. If the site allows longer passwords, 20 to 24 characters provides even more security without being difficult to manage, especially if you store it in a password manager. The most important factor is length: a 20-character password made of only lowercase letters is stronger than an 8-character password that uses every character type imaginable. Length beats complexity every time, because each additional character multiplies the number of possible combinations by the size of the alphabet.
Math.random is designed for simulations and games, not security. It produces numbers that are statistically random-looking but entirely predictable if someone knows the internal state. An attacker who observes a few outputs from Math.random can reconstruct its state and predict every future output, including your passwords. The crypto.getRandomValues function, by contrast, draws from an operating-system-level entropy source that is specifically designed to be unpredictable even to someone who has observed all previous outputs. For anything security-sensitive, always use the cryptographic API.
Ambiguous characters are those that look very similar in many fonts: the letter O and the digit 0, the lowercase l and the uppercase I, and the digit 1. When you need to type a password from memory or read it aloud, these characters cause confusion and transcription errors. Excluding them slightly reduces the total number of possible passwords, but the reduction is negligible for passwords of 12 characters or more, and the usability benefit is significant if you ever need to enter the password manually.
The generator first picks one character from each selected class — lowercase, uppercase, digits, symbols — and then fills the remaining positions from the combined alphabet. Finally, it shuffles the entire result using a Fisher-Yates shuffle driven by the same cryptographic random source. Without this step, the first few positions would always reveal which character classes were included, leaking information about the password structure to anyone who sees it.
Last updated on 2026-09-26 · Written by UtiliaTools