🔐

Password Generator

Generate cryptographically secure passwords with custom rules. Uses crypto.getRandomValues — nothing leaves your browser.

Settings
Length 20
UppercaseA–Z
Lowercasea–z
Digits0–9
Symbols!@#$%^&*
Exclude Similaril1Lo0O
Exclude Ambiguous{}[]()/\'"
Bulk Generate
Count
Strength
Time to crack
Generated in your browser — never sent to a server.
Advertisement
About this password generator

A free, no-signup password generator that builds strong, random passwords directly in your browser. Set a length from 4 to 128 characters, pick which character sets to include — uppercase A–Z, lowercase a–z, digits 0–9 and symbols !@#$%^&*()-_=+[]{}|;:,.<>? — and a live strength meter rates each result by entropy.

Every password is drawn from crypto.getRandomValues, the browser's cryptographically secure random number generator, so there's no predictable seed or weak Math.random output. People use it to:

Everything runs local and in-browser: each password is generated with the browser crypto RNG, nothing is uploaded, logged or sent to analytics, and the tool keeps working fully offline once the page has loaded.

How to use
  1. Drag the Length slider (4–128) — 16–20 is enough for most logins, 24+ for long-term secrets.
  2. Toggle the character sets — uppercase, lowercase, digits and symbols — to control which characters can appear.
  3. Optionally enable Exclude Similar (il1Lo0O) or Exclude Ambiguous ({}[]()/\'") for passwords you'll read or type by hand.
  4. Read the strength meter, then click the refresh icon to roll a new password or the copy icon to put it on your clipboard.
  5. For many passwords at once, set a Count under Bulk Generate and use Copy All or Download to save them.
FAQ

For everyday accounts, 16–20 characters with all four character sets is plenty — the strength meter hits Very Strong around 80 bits of entropy. For long-term secrets like a password-manager master key or root account, go to 24 or more. This generator supports any length from 4 up to 128.

Yes. Every character is drawn from crypto.getRandomValues, the browser's cryptographically secure RNG — the same source used for encryption keys and session tokens. There's no predictable seed and no weak Math.random, so the output is safe for security-sensitive use.

No. Generation, copy and download all happen locally in your browser. No password is logged, recorded by analytics or transmitted anywhere — the tool works fully offline after the page loads.

You can include uppercase (A–Z), lowercase (a–z), digits (0–9) and symbols (!@#$%^&*()-_=+[]{}|;:,.<>?). Exclude Similar drops look-alike characters (il1Lo0O) and Exclude Ambiguous removes brackets and quotes ({}[]()/\'") — both make passwords easier to read and type by hand. Using more sets increases the character pool and overall strength.

Yes — a password manager lets you give every site a unique, long, random password without memorising any of them. Generate the password here, then save it straight into your manager. Use the Bulk Generate option if you need to provision many accounts at once.

Passphrases made of several random words are easier to type and remember and can be very strong. This tool generates random-character passwords rather than word-based passphrases; for anything you store in a password manager, a long random password from here is the simplest secure choice.

No. Reusing a password means one breached site exposes every account that shares it. Generate a fresh, unique password for each login — that way a leak on one service can't be used to break into the others.