Strong Password Generator - Cryptographically Random

Use Password Generator

Passwords are drawn from crypto.getRandomValues, your browser's cryptographic random source, and never sent anywhere.

Length

Never generated from Math.randomMath.random is fast but predictable: given enough output, future values can be inferred. This tool uses the cryptographic generator instead, and discards biased draws so every character is equally likely.

Password

Press generate for a fresh password.

Your password will appear here.

Strength: Very strong
Entropy: 128.5 bits
Alphabet: 86 chars

Explore generators

Find related browser-local tools for nearby tasks without starting another search.

Browse all generators

About Password Generator

The only thing that matters in a password generator is where the randomness comes from, and it is the one thing you cannot see by looking at the output. A password produced by a weak source looks exactly as scrambled as one produced by a strong source, right up until someone reproduces it. This generator draws from your browser's cryptographic random source, discards draws that would skew the result, and shows the strength in bits so the number is not a marketing adjective. It runs on your device, so the password exists nowhere else at the moment it is created.

Build the document

Every character comes from crypto.getRandomValues, the interface browsers expose for cryptographic randomness. It is explicitly not Math.random, which is a fast general-purpose generator whose future output can be worked out from values it has already produced. For a password that difference is the whole game.
Biased draws are thrown away rather than folded in. Mapping a random byte onto an alphabet by remainder makes the first few characters slightly more likely whenever the alphabet does not divide 256 evenly, so any byte landing in the biased tail is discarded and a new one drawn. Every character is then equally likely.
Pick the length and which character types to include. Strength in bits is recalculated as you change either, because both matter: bits are the length multiplied by the log of the alphabet size.
Turn on the lookalike filter when a password has to be read aloud, copied from a screen, or typed on a television remote. It removes characters like l, I, 1, O and 0 that people routinely confuse, at a small cost in strength.

Ways to use Password Generator

A everyday account password

Twenty characters with all four types is comfortably past a hundred bits, which is beyond brute force for any realistic attacker. Store it in a manager and never see it again.

A password you have to dictate

Turn on the lookalike filter and drop symbols. Strength falls, so raise the length to compensate; the result is longer but survives being read over a phone.

A field with a short maximum

Some banks still cap passwords at twelve characters. Use every character type allowed, accept the lower entropy, and make sure that password is unique to that one site.

Check before sending it

Length beats complexity. Adding symbols to a twelve-character password helps far less than making it twenty characters long, because bits grow linearly with length and only logarithmically with alphabet size. If a site limits you to a short password, that limit is the weakness, not your choices here.
Entropy describes the generator, not the string. A password of twenty random characters has the strength shown; a memorable phrase of the same length does not, because it was drawn from a far smaller space of plausible phrases. Never assume a password you invented scores like one that was generated.
A generated password is only useful with a password manager. Nobody remembers twenty random characters, and writing them down or reusing one across sites destroys the benefit. Generate directly into a manager rather than into a note.
This page cannot judge a password you already have. It measures what its own settings would produce, and has no way to know whether a password you typed elsewhere was chosen well or appears in a breach list.
Reproducible mode is not password recovery. It derives the same result only when the master phrase, service, account label, counter, length and character settings match exactly. Never use a cryptocurrency wallet recovery or seed phrase as the master phrase.

Questions about Password Generator

Is the password sent anywhere or stored?

No. It is generated in your browser and exists only in this tab. The site has no endpoint that could receive it, no analytics runs on the page, and nothing is written to storage. Closing the tab is the end of it.

Why does Math.random matter so much?

It is designed for speed, not secrecy. Its internal state can be reconstructed from output it has already produced, which means passwords built from it can be predicted. Cryptographic generators are specifically built to make that infeasible.

How many bits are enough?

Below 40 is weak, 60 is fair, 80 is strong, and above 100 is beyond any realistic brute-force attempt. The figure shown updates as you change the length and character types.

Should I include symbols?

They help, but less than people assume. Going from letters and digits to adding symbols gains a few bits per character; adding several more characters gains more. Include them unless the destination rejects them.

Can I generate the same password again later?

Random mode deliberately creates a new password every time. Reproducible mode can recreate a password from the same master phrase and saved non-secret recipe, but it cannot recover a forgotten phrase or infer missing settings.

Is the master phrase saved or uploaded?

No. The phrase is used by Web Crypto inside this tab and is not included in the copied recipe. It is never uploaded or written to browser storage.

Password Generator