Plenty of “random” password generators quietly reach for
Math.random() because it’s the obvious function name. It’s also the
wrong tool for the job: Math.random() is a fast pseudo-random
generator meant for animations and games, not secrets, and it is not
cryptographically secure.
Our new random password generator
uses crypto.getRandomValues() instead — the same quality of
randomness browsers use for encryption keys:
- Real randomness — every character is drawn from a cryptographically secure source, not a predictable pseudo-random one.
- Full control — length from 4 to 128, and independent toggles for uppercase, lowercase, numbers, and symbols.
- Ambiguous-character exclusion — optionally strip look-alikes like
i l 1 L o 0 Ofor passwords you’ll type by hand. - An honest entropy estimate — length × log2(character-set size), in bits, with a plain-language strength label and a note that it’s a simplification.
- A friendly guard — turn off all four character sets and the tool tells you, instead of generating nothing.
Settings sync to the URL so you can share a pre-configured link — the generated password itself never does, since a live secret has no business in your browser history.
Also available en español and embeddable with a single iframe.