About Password Generator

This tool generates passwords using crypto.getRandomValues() — the browser's cryptographically secure random number generator. You can configure length from 4 to 128 characters, choose which character sets to include (uppercase, lowercase, digits, symbols), exclude visually ambiguous characters, and even supply a fully custom charset.

Every password is generated entirely client-side and never transmitted anywhere. The entropy display and estimated crack time help you understand exactly how strong each output is relative to a modern brute-force attacker running a trillion guesses per second.

Common Use Cases

Creating a strong master password for a new password manager vault that you can write down and store securely
Generating API keys or secret tokens when a service doesn't auto-provision them for you
Batch-generating temporary passwords for multiple new employee accounts via the ×5, ×10, or ×20 bulk mode
Producing database passwords that satisfy strict policy rules using the custom charset and exclusion options

How to Use

Drag the Length slider or type a number directly — the password regenerates automatically
Check or uncheck character set options; enable "Exclude ambiguous" to remove characters like 0, O, l, and I
Click the generated password or the Copy button to copy it to your clipboard
Use ×5, ×10, or ×20 to generate a list of unique passwords at once, then copy all with one click

Frequently Asked Questions

What does "entropy" mean and why does it matter?

Entropy (measured in bits) quantifies how unpredictable a password is. It is calculated as length × log₂(charset size). A 20-character password drawn from all four character sets has roughly 131 bits of entropy — meaning an attacker would need to try 2¹³¹ combinations on average to crack it by brute force, which is computationally infeasible even with nation-state resources. Aim for at least 80 bits for personal accounts and 128+ bits for long-lived secrets.

Is it safe to generate passwords in a browser?

Yes, provided the page itself is trustworthy and your device is not compromised. This tool uses the same OS-level CSPRNG that security libraries use, generates everything locally, and makes no network requests. You can verify this by opening DevTools → Network and generating — you will see zero outbound requests triggered by the generator logic.

What is the custom charset option for?

Some services enforce specific password policies that allow only a subset of symbols, or require special characters from a restricted list. The custom charset field lets you type exactly the characters you want to draw from, overriding the checkboxes entirely. For example, entering abcdefABCDEF0123456789 produces hex-only passwords useful for certain API token formats.