Generated on your screen only — never sent, never stored

Random Password Generator

True cryptographic randomness (crypto.getRandomValues). Our server never sees a single character.

0 B uploaded — nothing you enter has been sent anywhere?

Passwords are generated on your screen and never sent or saved anywhere. All the code runs inside this page — turn off your Wi-Fi and it still works exactly the same. They disappear on refresh, so copy what you need into your password manager right away.

Other tools send what you type to a server and process it there. Even when they promise to erase it afterwards, your content sits on someone else’s machine in the meantime. Here there is no sending step at all. The more sensitive the content — passwords, contract wording, private notes — the more that difference matters. See how to verify it →

A different password for every site, without having to invent one

Passwords people make up tend to be small twists on birthdays or favorite words, and one leak can expose every account that shares the pattern. This generator uses your browser’s cryptographic randomness to produce five candidates at once and rates their strength in bits of entropy. The passwords appear only on your screen and are never sent or stored.

A closer look

Generation uses the browser’s built-in crypto.getRandomValues rather than Math.random. When a random number is mapped onto the list of characters, values that would slightly favor the first few characters are thrown away and drawn again, so every character is equally likely. The generator first places one character from each type you switched on, fills the rest from the combined pool and then shuffles, so rules such as “must contain an uppercase letter, a digit and a symbol” are always met. The symbol set has 23 characters, including ! @ # $ % ^ * ( ) - _ = + [ ] { } ? / ~, and never uses quotes, backslashes, commas, periods or spaces.

The meter works out entropy as length × log2(number of possible characters) and sorts it into four bands: under 40 bits is Weak, under 60 is Fair, under 100 is Strong, and 100 or more is Very strong. With all four types on there are 85 possible characters, so the default 16 characters give about 103 bits, 12 give 77 and 8 give 51. Turning on Exclude look-alikes removes lowercase l, the digit 1, capital I, capital O and the digit 0, leaving 80 characters; a 16-character password then scores about 101 bits.

How to use it

When it helps

Securing your email firstPassword resets for most other accounts arrive by email, so give your inbox a random password of 16 or more characters before anything else.
One password per sign-upGenerate a fresh password every time you register, so a breach at one site doesn’t unlock your accounts elsewhere.
Wi-Fi keys that guests typeFor a router password people enter by hand, exclude look-alikes, switch off symbols and make it longer instead.
Sites that ban symbolsUntick Symbols and raise the length to 17 or more; the meter climbs back to Very strong at over 100 bits.

Common snags

The list is empty and it asks me to select a character type.All four types are switched off. Turn at least one back on and new passwords appear immediately.
The site rejects one of the symbols.Some sites refuse angle brackets or other particular symbols. Pick a candidate without that character, or switch symbols off and add length.
A character appears twice in the same password.Each position is drawn independently, so repeats are normal; banning them would actually shrink the number of possibilities. If a site forbids repeated characters, choose another candidate.
The site allows only a short maximum length.Set the slider to that limit and keep as many of the four types switched on as the site allows, which gives the highest strength possible at that length.

Tip Changing any option replaces the whole list and the old candidates are gone, so save the password in your password manager before pasting it into the sign-up form.

Password generator FAQ

Is this password generator actually secure?

Yes. It uses your browser's built-in crypto.getRandomValues — a cryptographically secure random number generator — with unbiased sampling. Nothing is transmitted: the passwords exist only on your screen. Proof: disconnect from the internet and the generator keeps working.

How long should a strong password be?

Use 16+ characters for important accounts (email, banking). Strength is measured in entropy bits: 16 characters mixing upper/lowercase, digits and symbols gives about 103 bits, which is far beyond brute-force reach today. Below 60 bits, cracking becomes realistic.

When should I exclude look-alike characters?

Turn it on when you'll read the password off the screen and type it by hand — lowercase l, digit 1, capital I, capital O and digit 0 are easy to confuse in many fonts. It slightly reduces the character pool, so leave it off for copy-paste passwords.

How am I supposed to remember random passwords?

Don't. Store them in a password manager (your browser's built-in one, 1Password, Bitwarden, etc.). A unique random password per site plus two-factor authentication is the gold standard — reusing one password everywhere is the single worst habit.

A site rejects symbols. What now?

Untick Symbols and add 4–6 extra characters of length instead — length compensates for the smaller pool. The easiest upgrade is always: make it as long as the site allows.