Generate strong, random passwords using your browser's secure RNG
A tool that builds random, character-based passwords entirely in your browser — set a length, choose which character types to include, and generate one password or a whole batch at once.
crypto.getRandomValues, the browser's cryptographically
secure random number source — the same one used for security-sensitive code, not the weaker
Math.random(). Generation happens locally; nothing is sent to a server, logged, or stored.
Drag the length slider, 4–64 characters.
Toggle which character types to include.
Copy the result, or click Generate New for another.
The bar reflects entropy, calculated from the password's length and how many character types are turned on — more length and more variety both push it toward Strong or Very strong. It's a mathematical estimate of how hard the password is to guess, not a check against real-world leaked password lists.
Longer beats more complex: a longer password with fewer character types can still out-resist a shorter one packed with symbols, because length has an outsized effect on entropy. 16+ characters with all four character types on is a reasonable default for most accounts.
Set a count from 1 to 50 and click Generate Batch to get a whole list at once, each with its own Copy button — useful for provisioning multiple test accounts, temporary credentials, or API keys in one pass instead of regenerating one at a time.
A secure generator picks each character independently from your chosen character sets using a source of
randomness unpredictable enough that past output gives no clue about future output. That's exactly what
crypto.getRandomValues provides — unlike a plain pseudo-random function, its output
can't be reverse-engineered from previous results.
Yes. Every password is generated in your browser using crypto.getRandomValues, the same cryptographically secure random number source browsers use for security-sensitive code. Nothing is sent to a server, logged, or stored anywhere.
Each character is picked using the Web Crypto API's crypto.getRandomValues, a cryptographically secure random number generator, from whichever character sets (lowercase, uppercase, numbers, symbols) you've enabled.
No. Nothing is saved, logged, or sent anywhere. Once you leave or refresh the page, a password that wasn't copied is gone.
No. It only generates character-based passwords from letters, numbers, and symbols, not memorable multi-word passphrases like "correct-horse-battery-staple".
One at a time with Generate New, or up to 50 at once with the batch generator.
Entropy, calculated from the password's length and how many character types are enabled. It's a mathematical estimate of guess-resistance, not a check against known leaked password lists.