Password generator
Strong passwords, generated entirely on your device. Nothing is sent to any server — ours or anyone else's. Every byte comes from the browser's cryptographically secure random number generator, the same OS-level source behind the browser's other security-critical randomness.
Options
This password
* Years to reach a 1% chance of a match at 1,000,000,000,000 guesses per second.
Generated · 0 passwords
How it works
Randomness. Every byte comes from crypto.getRandomValues — the browser's cryptographically secure generator, seeded by the operating system's entropy pool, the same CSPRNG the browser relies on for other security-critical randomness.
Bias-free mapping. Bytes are mapped to your character set using rejection sampling — a byte is only used if it falls below the largest multiple of the alphabet size that fits in a byte; anything at or above that cutoff is discarded and redrawn. Without this, the distribution would skew toward earlier characters, weakening every password.
Character sets. Toggle uppercase, lowercase, numbers, and a curated symbol set independently. Each enabled set contributes its full range to one merged alphabet, and every character is then drawn uniformly from that merged alphabet — so enabling a set does not guarantee that the set appears in the password. At the default 20 characters over uppercase, lowercase and numbers, roughly 1 password in 34 contains no digit at all; at 8 characters it is roughly 1 in 4, and with symbols enabled at 8 characters roughly 1 in 3 contains no symbol. That is deliberate: reserving a position for each set would rule out every password that does not match the pattern, shrinking the combination count above and lowering the entropy. If a signup form rejects a password for missing a digit or a symbol, press Regenerate or add a few characters to the length — do not reach for a weaker generator.
Easy to read. Strips characters that look alike in most fonts — 1/l/I/i, 0/O/o, 5/S/s, 2/Z/z, 8/B, 6/G, 9/q — so the password is unambiguous when read aloud or typed by hand. The alphabet shrinks, which lowers entropy slightly; bump the length up a few characters to compensate.
Strength. Entropy is calculated as log₂(alphabet) × length and bucketed into a label: < 40 bits is Very weak, < 60 is Weak, < 80 is Decent, < 256 is Strong, and ≥ 256 is Very strong. For reference, 80 bits is comfortable for everyday accounts, 128 bits resists well-funded offline attackers, and 256 bits matches an AES-256 key. The label reflects this math only — it does not check against dictionaries or breach lists, because the generator only ever produces uniformly random output.
Privacy. Passwords are generated in your browser and never leave it. Nothing is sent to any server, nothing is stored, and closing the tab destroys the output.