Password GeneratorPrivate, Instant, In Your Browser
Choose a length from 8 to 64 characters, toggle uppercase, lowercase, digits and symbols, and generate. The randomness comes from your browser's crypto.getRandomValues — the same cryptographic source password managers use — not from a guessable pseudo-random function. And this matters more here than anywhere: a password generated on someone's server has already been seen by that server. Ours is born on your device, shown to you alone, and forgotten when you leave.
Updated January 2026
Strong — about 103 bits of entropy
Generated by crypto.getRandomValues on your device — we never see a single character.
About this tool
A cryptographically secure password generator draws randomness from an unpredictable entropy source — in browsers, crypto.getRandomValues from the Web Crypto API — rather than a guessable pseudo-random function.
- The Web Crypto API, which provides crypto.getRandomValues, became a W3C Recommendation in 2017 and is implemented in every modern browser.
- NIST's password guidance (SP 800-63B, published 2017) recommends favoring length over forced complexity rules and supporting passwords of at least 64 characters.
- Password strength is measured in entropy bits — length × log₂(alphabet size) — so a 16-character password from a 94-symbol pool carries about 105 bits, far beyond brute-force reach.
About the Password Generator
The quality of a password generator is invisible in its output — any tool can print 16 random-looking characters — so the two questions that matter are where the randomness comes from and who else sees the result. This generator draws from crypto.getRandomValues, the browser's cryptographically secure source (part of the W3C Web Crypto API, standardized in 2017), with rejection sampling so every character in your chosen pool is exactly equally likely. No Math.random(), no patterns, no bias.
The second question matters more than people think: a password generated on someone's server has been seen by that server, however briefly, and transits the network to reach you. Ours is generated in your tab's memory, displayed to you alone, and ceases to exist when you leave. There is no request carrying it, no log line containing it, nothing to subpoena or breach.
On strength: modern guidance (NIST SP 800-63B, 2017) favors length over forced complexity. The math agrees — each character multiplies the search space, so 16 characters from a full 94-symbol pool is roughly 105 bits of entropy, far beyond any feasible brute force, and 20+ characters is sensible for master passwords. The strength meter shows this entropy figure live. Symbols help, but four more characters help more than any symbol requirement.
The honest advice, though, is that the best generated password is one you never see: use a password manager, let it generate and store. This tool is for the moments outside that flow — a Wi-Fi password, a shared account, a system that a manager doesn't reach — and for those, generated-locally is the only standard worth accepting.
Frequently Asked Questions
How random are these passwords really?
We draw bytes from crypto.getRandomValues, the browser's cryptographically secure generator, and use rejection sampling so every character in the pool is exactly equally likely. That's the same quality of randomness dedicated password managers use.
How long should my password be?
For anything protected by a modern service, 16 characters with all four character sets is far beyond brute-force reach (over 100 bits of entropy). Go longer for master passwords; the slider reaches 64.
Could anyone else see a password generated here?
No. Generation happens in your tab's memory with no network request — we never see it, it isn't stored, and it disappears when you close the page. Copy it into a password manager rather than a text file.
What does the strength hint mean?
It shows the password's entropy — length × log₂(pool size) — in bits. Roughly: under 50 bits is weak, 50–80 is fine for most accounts, and 80+ is strong enough that brute force stops being a realistic threat.
Every conversion runs 100% in your browser — zero files uploaded, ever.
How to verify it yourself →