Random Password Generator
Set your options — the password is generated instantly with a cryptographically secure random source, entirely in your browser.
Turn on at least one character set to generate a password.
Real randomness, not Math.random
Most in-browser password generators reach for Math.random()
because it's the obvious function name. The problem is that
Math.random() is a fast pseudo-random generator built
for graphics and simulations, not security — it is not designed to
resist prediction, and treating its output as a secret is a real,
documented weakness. This generator uses
crypto.getRandomValues() instead, which draws from
your operating system's cryptographically secure random number
source — the same quality of randomness used to generate
encryption keys. Every character is chosen independently from
whichever sets you've enabled, and the "exclude ambiguous
characters" option strips look-alikes (i l 1 L o 0 O)
from those sets before picking begins, which helps when a password
has to be typed or read aloud rather than pasted.
Worked example
With the default settings — length 16, all four character sets on, ambiguous exclusion off — the combined character set has 88 characters (26 uppercase + 26 lowercase + 10 digits + 26 symbols). Entropy is length × log2(character-set size): 16 × log2(88) ≈ 16 × 6.459 ≈ 103.4 bits, which this tool labels "Very strong." Turning off symbols and numbers drops the set to 52 characters and the same length to about 91.2 bits — still strong, but the math shows exactly what each option costs you.
Frequently asked questions
Why crypto.getRandomValues instead of Math.random?
Math.random() is generated by a fast, predictable pseudo-random algorithm meant for things like animations and games — it is NOT cryptographically secure, and in some browser engines its internal state can be reconstructed from a handful of outputs. crypto.getRandomValues() draws from the operating system's cryptographically secure random number generator, the same source used for encryption keys. For anything protecting an account, that difference is the whole point.
How long should a password be?
16 characters or more for anything important — email, banking, your password manager's master password. 12 is a reasonable floor for lower-stakes accounts. Length matters more than cleverness: a long random password beats a short one with substitutions like 'P@ssw0rd!', which attackers already account for.
What is entropy and why does it matter?
Entropy measures how many guesses an attacker would need, expressed in bits — each extra bit doubles the search space. It's calculated here as length × log2(character-set size). More bits means a larger space to brute-force, but it's a simplification: it assumes every character is drawn independently and uniformly at random, which is true for this generator but not for passwords humans invent themselves.
Is my generated password stored anywhere?
No. The password is generated and displayed entirely in your browser using JavaScript — it is never sent to a server, logged, or written to the URL. Once you navigate away or close the tab, it's gone unless you copied it.