Password Generator

What makes a password generator trustworthy

Two things matter for a password generator, and most of what makes one better than another comes down to them. First, the randomness: passwords must come from a cryptographically secure random number generator, not an ordinary one. Math.random() is fast and fine for a game or a UI animation, but it is not specified to be unpredictable, and some implementations of it can be predicted after seeing enough output. This tool uses crypto.getRandomValues() instead, the Web Crypto API's CSPRNG, the same source browsers use for TLS keys. Second, where the password is computed: if it happens on a server, the operator could log it, by accident or on purpose. This page has no server: it is a static file, and every password is generated by JavaScript running on your device.

What the tool will not do is pretend a password is safe because it is long. A password is only as good as where it ends up: reused across sites, pasted into a chat, or stored in a browser with no master password all undermine even a maximally random one. Use a password manager to store what this generates.

Example

The default settings (16 characters, all four character types, no exclusions) draw from a88-character pool and produce something like:

6ey@Oa;o93V3Z2h^

That password carries 103.4 bits of entropy (Very strong), with a88-character pool, every extra character adds about 6.5bits, so length matters more than which character types you enable.

Options explained

• Length sets how many characters to generate: the slider covers 4 to 64, and the number field next to it takes anything from 1 to 128 (the underlying engine accepts up to 512). Entropy grows linearly with length, so this is the single biggest lever on strength.
• A-Z / a-z / 0-9 / !@#$ (uppercase, lowercase, numbers, symbols) each add their character set to the pool. At least one must stay ticked. Symbols are the set every US/UK keyboard types directly: !@#$%^&*()-_=+[]{};:,.<>/?, no alt-codes or dead keys.
• No 0 O 1 l I (exclude ambiguous characters) removes 0, O, 1, l and I from whichever sets are enabled, for a password a person has to read or type by hand.
• How many generates several passwords at once from the same settings (useful for picking one you like, or setting up several accounts in one pass), listed one per row with their own Copy button. Every password in a batch is independently random; the strength shown applies to all of them equally, since they share the same options.
• Strength bar: four segments from Weak to Very strong, the entropy in bits, and the average time to guess it by brute force at 10 billion guesses a second, roughly a fast offline attack on a leaked, weakly hashed password list. It is a measure of randomness only: a strong-looking password that has been reused or leaked elsewhere is not protected by it. Digits are shown in blue and symbols in amber so similar-looking characters are easy to tell apart.
• ↻ New produces a fresh batch on demand; a password also appears automatically on page load and whenever an option changes, so there is always one ready.

Edge cases and common errors

• A short password cannot guarantee every type. With all four types selected, the tool tries to include at least one of each, but that needs at least 4 characters. A 4-character password from the same settings might read sD[7: still four random characters from the full pool, just not provably one of each. Verified by generating 200 eight-character passwords at build time and confirming every one contained all four types when eight characters were requested.
• Selecting no character type is refused rather than silently falling back to a default: "Select at least one character type."
• Excluding ambiguous characters from a numbers-only password removes only 0 and 1, leaving 8 digits (23456789): a 6-digit PIN-style code from that pool, such as 572795, still carries 18 bits, noticeably less than the default because the pool is so much smaller.
• Numbers only is weak at any reasonable length. A 12-digit PIN-style code such as 039263245952 carries only 39.9 bits (Weak). A 10-digit numeric pool is small enough that even a fairly long code searches a small space. Add letters or symbols, or increase the length substantially, to reach Strong.
• A tiny password is always weak. At 4 characters, even from the full 88-character pool, entropy is only 25.8 bits (Weak); length below about 12 characters cannot reach Strong regardless of which character types are enabled.
• Every password in a batch is independent. Generating 100 at once does not make any of them weaker or more predictable than generating one; nothing about one password in the list depends on another.

Do the same thing in code

JavaScript (browser or Node.js)

function randomPassword(length, charset) {
  const bytes = new Uint8Array(length);
  crypto.getRandomValues(bytes);
  return Array.from(bytes, (b) => charset[b % charset.length]).join("");
  // Note: "b % charset.length" is a simplification and reintroduces a small
  // modulo bias unless charset.length evenly divides 256 -- this page's own
  // engine (src/lib/password-generate.ts) uses rejection sampling instead.
}
const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()-_=+[]{};:,.<>/?";
const password = randomPassword(16, charset);

Python

import secrets, string
charset = string.ascii_letters + string.digits + "!@#$%^&*()-_=+[]{};:,.<>/?"
password = "".join(secrets.choice(charset) for _ in range(16))  # secrets, never random

Shell

openssl rand -base64 24 | tr -d '=+/' | cut -c1-16   # quick, but not character-type-aware
pwgen -sy 16 1                                       # if pwgen is installed

Once you have a password, a UUID is the usual next thing generated alongside it for a new account or API key; if the account needs a JWT decoded later, the JWT decoder is the tool for that.