Password Generator
Generate a strong random password using your browser's cryptographic random number generator — not Math.random(). Adjust the length (8–64 characters) and toggle uppercase letters, lowercase letters, numbers, and symbols to match any site's password policy. A strength indicator gives instant feedback, and your password is never transmitted anywhere.
Character Sets
Related Tools
[2 suggestions]About the Password Generator
This tool generates passwords using crypto.getRandomValues(), the Web Cryptography API's cryptographically secure pseudo-random number generator (CSPRNG). Unlike Math.random(), which is deterministic and predictable from a seed, crypto.getRandomValues() draws from the operating system's entropy pool (equivalent to /dev/urandom on Linux), making the output suitable for security-sensitive use. Password strength is estimated based on two factors: the effective alphabet size (how many distinct character types are enabled) and the total length. A 16-character password using all four character sets has approximately 95^16 ≈ 4.4 × 10^31 possible combinations — well beyond brute-force capability. The strength indicator maps to "Weak" (< 8 chars or single character type), "Medium" (8–11 chars with mixed types), or "Strong" (12+ chars with 3+ character types). For passwords that protect sensitive accounts, always use a password manager to store the result rather than memorizing or writing it down.
Is this password generator truly random?▾
Yes — it uses the browser's crypto.getRandomValues() API, which draws from the OS entropy pool. This is cryptographically secure and cannot be predicted, unlike Math.random().
What makes a password "strong"?▾
The strength indicator rates passwords as Strong when they are 12 or more characters long and use at least 3 character types (uppercase, lowercase, numbers, symbols). Longer passwords with more character variety take exponentially longer to crack.
Is my generated password stored anywhere?▾
No — all generation happens entirely in your browser using JavaScript. The password is never sent to any server, logged, or stored. Close the tab and it is gone.