Security
Processed locally in your browser — not uploaded
Password Generator
Generate strong random passwords with configurable length and character types, an option to exclude ambiguous look-alike characters, and a live entropy/strength estimate. Uses the browser's cryptographically secure random source, not Math.random(). Runs entirely in your browser.
OQ=YtCM$X_sl7[-s
103 bits · strong
01
How to use
- Set the length and choose which character types to include.
- The password regenerates automatically as you change options, or click Generate for a new one with the same settings.
- "Exclude ambiguous characters" removes look-alikes like 0/O and 1/l/I, useful when a password needs to be typed or read aloud.
02
Understanding the output
Generated using crypto.getRandomValues (the browser's cryptographically secure random source), with rejection sampling so every character in the selected set has an exactly equal chance of appearing — a naive random-index calculation can subtly favor some characters over others.
03
Common issues & tips
- •"Select at least one character type": at least one of uppercase, lowercase, numbers or symbols must be enabled.
- •Entropy (bits) estimates how hard the password is to brute-force — higher is better; 70+ bits is generally considered strong for most purposes.
Frequently asked questions
- Is this actually random, or could it be predicted?
- It uses crypto.getRandomValues(), the browser's cryptographically secure random number generator — the same source used for generating encryption keys — not Math.random(), which isn't safe for anything security-related.
- What does the entropy number mean?
- It's the number of bits of randomness in the password (length × log2 of the character set size) — a rough measure of how many guesses an attacker would need. 70+ bits is generally considered strong.
- Is my generated password sent to a server?
- No. Generation happens entirely in your browser and nothing is transmitted or logged.