Strong Password Generator
Generate strong random passwords in your browser. Adjustable length, character sets, no ambiguous characters, plus a passphrase mode. Nothing is transmitted.
Generated passwords
The result appears here as you type.
What this tool is for
A generated password is only as trustworthy as the place it was generated. This one is built in your browser with crypto.getRandomValues, the cryptographic random source, and the page never sends a request containing it. Nothing to log, nothing to intercept, and you can disconnect from the network first and it still works.
How to use it
- Set the length: 16 characters is a sensible floor for an account that matters.
- Choose which character sets to include, or switch to passphrase mode for something you can type from memory.
- Generate, check the strength estimate, copy it straight into your password manager.
Frequently asked questions
How is randomness generated?
Through the Web Crypto API, using the operating system entropy source, with rejection sampling so every character in the chosen alphabet is equally likely. Math.random is not used anywhere.
How long should a password be?
For a password protected by a manager, 16 to 20 random characters is far beyond what offline cracking reaches. For something you must type by hand, a four or five word passphrase is easier and equally strong.
Are ambiguous characters worth excluding?
Only when the password will be read aloud or copied by hand. Excluding l, I, 1, O and 0 shrinks the alphabet slightly, which is a fair trade for a Wi-Fi password on a note but pointless inside a manager.