Password Generator.
Cryptographically secure. Nothing stored. Nothing sent.
Configuration
Why you need a strong password.
Weak passwords are the most common entry point for account takeovers. Attackers use automated tools that can test billions of guesses per second against leaked password hashes. A 6-character lowercase password can be cracked in under a second. A 16-character random password with all character types would take millions of years with the same hardware.
This generator uses the browser's cryptographic random number API — the same standard used by operating systems for security keys. Every password is different, truly random, and never logged.
Capabilities
What You Get
Real entropy from the Web Crypto API, with a strength read-out that reflects the character set you actually chose.
Crypto-Grade Random
Uses the Web Crypto API, not the predictable Math.random.
8 To 128 Characters
Set any length, from a short PIN to a full passphrase-length key.
Character Toggles
Switch uppercase, lowercase, numbers, and symbols independently.
Strength Meter
Live feedback on how resistant the result is to brute force.
One-Click Copy
Copy straight into your password manager without selecting text.
Never Logged
Generated passwords exist only in your tab — nothing is stored or sent.
Related tools.
More free browser-based utilities, connected by category and use case.
JWT Decoder
Paste any JSON Web Token and instantly see the decoded header, payload, expiry, and issued-at date in a clean readable layout. Runs entirely in the browser — nothing sent anywhere.
Base64 Encoder / Decoder
Encode or decode Base64 strings and files instantly. Also handles URL encoding/decoding and HTML entity encoding. Useful for auth headers, data URIs, and API payloads.
QR Code Generator
Generate QR codes for URLs, plain text, WiFi credentials, or vCard contact info. Set size, foreground/background color, and error correction level. Download as PNG or SVG.
FAQ
Password Generator FAQ.
Is this password generator truly random?
Yes. The tool uses the browser's built-in crypto.getRandomValues() API, which generates cryptographically secure random numbers. This is the same entropy source used by password managers and security tools.
Does this tool store or send my passwords anywhere?
No. The generator runs entirely in JavaScript in your browser. No password is ever sent to a server, logged, or stored. Close the tab and it's gone forever.
How long should my password be?
At minimum, use 12 characters for non-critical accounts and 16+ for email, banking, and password manager master passwords. Longer is always better — a 20-character random password is essentially uncrackable with current technology.
What makes a password strong?
Length, randomness, and character diversity. A strong password is long (16+ chars), fully random (not a phrase), and uses all character types. Avoid dictionary words, names, or predictable patterns even if you substitute letters with numbers.
Should I include symbols in my password?
Yes, when allowed by the site. Symbols increase the character set size from 62 (alphanumeric) to 95 (all printable ASCII), which significantly increases the number of possible combinations and time to brute-force.
What is the entropy of the passwords generated?
With all character sets enabled (95 characters), a 16-character password has approximately 105 bits of entropy (log2(95^16) ≈ 105). NIST considers 112+ bits sufficient for long-term security.
