Generate strong, random passwords using your browser's Web Crypto API (crypto.getRandomValues) — the same cryptographic randomness used by security software. Choose password length (4–64 characters), which character sets to include (uppercase, lowercase, numbers, symbols), and generate single or multiple passwords at once. Nothing is sent to any server. Passwords are generated entirely on your device.
Set your password length
Drag the length slider between 4 and 64 characters. For most accounts: 16 characters is excellent. For high-value accounts: 20+ characters. For PINs: 6–8 numbers only.
Choose character sets
Enable uppercase (A–Z), lowercase (a–z), numbers (0–9), and symbols (!@#$%^&*...). Combining all four gives the maximum entropy per character. Enable only numbers for PINs.
Generate and copy
Click Generate to create a password. Click Copy to copy it to clipboard. Paste directly into your password manager or account registration form.
Generate multiple passwords
Select 5, 10, or 20 from the dropdown to generate multiple passwords at once — useful for creating passwords for multiple accounts in one session.
Yes. This tool uses crypto.getRandomValues(), which is the Web Crypto API built into all modern browsers. It generates cryptographically secure pseudorandom numbers from an OS-level entropy source (hardware interrupts, timing variations, etc.). This is the same entropy source used by OpenSSL, bcrypt, and other security-critical software. It is NOT suitable for generating seeds for gambling or lottery — but it is absolutely suitable for passwords.
With all character sets enabled: 12 characters provides ~72 bits of entropy (sufficient for most accounts), 16 characters provides ~96 bits (excellent for high-value accounts like banking and email), 20+ characters provides 120+ bits (suitable for master passwords and encryption keys). Password strength depends on entropy (bits), not just length. A 20-character password from all four character sets is far stronger than a 30-character password using only lowercase.
No. Passwords are generated entirely in your browser using JavaScript and Web Crypto. They are never sent to our servers, not logged, not stored, and not transmitted over the network. Each password exists only in your browser's memory until you copy it and it clears when you navigate away. We have no access to any passwords you generate here.
Our symbol set: !@#$%^&*()-_=+[]{}|;:,.<>? — 27 symbols. This includes the most common symbols accepted by websites. Some sites have unusual restrictions (max password length, no certain symbols). If you encounter a rejected character, regenerate without symbols enabled and rely on length for security.
Yes. The purpose of a strong random password is that it's impossible to remember — that's the point. Store generated passwords in a password manager like 1Password, Bitwarden (open source, free), or Keychain (built into Apple devices). Use a different strong password for every account. If one service is breached, your other accounts remain secure.
Something not working? Report a bug
