Random password generator
Passwords built from the browser's cryptographic random source. Generate dozens at a time — everything happens on this device, nothing is stored or sent.
What "strong enough" actually means
Strength comes down to two things: length and alphabet size. This tool estimates entropy as length × log2(alphabet), in bits. Every extra bit doubles the number of guesses an attacker needs.
- Under 50 bits — weak. Not for anything that matters.
- 60 to 80 bits — fine for everyday accounts.
- Over 80 bits — strong. Use this range for email, banking and password-manager master passwords.
Rule of thumb: 16 characters from the full set is about 105 bits, which no realistic amount of computing power will brute-force.
Practical advice
- Use a different password per site, so one breach does not cascade.
- Let a password manager remember them. Do not rely on a pattern like "base word + site name" — those are the first thing cracking tools try.
- Two-factor authentication on email, banking and cloud storage protects you more than stretching a password to 40 characters.
- Do not leave plaintext copies in a browser, especially on a shared machine. This page keeps no history — a refresh clears everything.
FAQ
Are these passwords actually random?
Yes — they come from crypto.getRandomValues(), the operating system's cryptographic source, not from Math.random(), which is predictable and unsuitable for passwords.
Can the page record what it generates?
No network request is made and nothing is written to cookies or local storage. Close the tab and nothing remains.
I checked every class but do not see all of them in the output
At short lengths (6 characters, say) a class may appear only once. The algorithm guarantees at least one character from every class you tick.