Written by Alex Chen · Reviewed by Jane Smith · July 18, 2026
Generate strong, random passwords using cryptographically secure randomness. Customize length and character sets.
Adjust settings and click Generate.
Every generated password is a sequence of characters drawn from the pool you enable with the checkboxes. Uppercase contributes 26 letters, lowercase another 26, digits add 10, and the symbol set supplies 26 more (the printable symbols like !, @, #, and $). With all four groups checked, the pool holds 88 characters. Tick "Exclude ambiguous characters" and seven look-alikes — 0, O, 1, l, I, 5, and S — are stripped out, leaving 81 when every group is on. The length slider runs from 4 to 128 characters, and the count box accepts 1 to 100 passwords in a single batch.
The generator calls crypto.getRandomValues() with a Uint32Array sized to the requested length, then chooses each character by taking a 32-bit value modulo the pool size. That API is the browser's cryptographically secure random generator, seeded from the operating system's entropy sources rather than from Math.random(), a deterministic pseudo-random routine meant for statistics and not for secrets. Because the whole procedure runs inside the page, the passwords are assembled locally and never cross the network. Changing any checkbox, the slider, or the count re-rolls the batch immediately, and the Generate button forces another roll without touching the settings.
The strength badge is computed by a fixed six-point rubric: one point for reaching 8 characters, another at 12, another at 16, one for mixing upper and lower case, one for containing a digit, and one for containing a symbol. The badge reads Very Strong only at six points, which means a 16-or-more-character password that uses all four character groups. Drop the symbols and a 16-character password lands at five points (Strong), and a 12-character password with all four groups also scores Strong. At the short end, eight digits score two points and are labeled Weak, while even the four-character minimum can reach Medium when every group is enabled — a reminder that the badge counts policy boxes ticked, not the true search space of the password.
Each character drawn from the 88-character pool carries log2(88), or about 6.46 bits, of entropy. A 16-character password using all four groups therefore holds roughly 103 bits; with the ambiguous characters excluded the pool shrinks to 81 characters and the same length holds about 101 bits. Cutting to 12 characters with the full pool drops the figure to about 78 bits. Length dominates this math because each added character multiplies the search space by the pool size — one more character multiplies the combinations by 88, while adding the symbol group improves the per-character multiplier only from 62 to 88.
Because the rubric grants the symbol point only when a non-alphanumeric character is present, and without one the score caps at five. The entropy still grows with length, so a 20-character letters-and-digits password carries more bits than a 16-character one with symbols — the badge simply follows its own six-point rules.
Yes. The Generate button re-rolls the batch on demand, and adjusting any checkbox, the slider, or the count also triggers a fresh generation automatically.
It copies the generated passwords separated by newlines and shows a toast naming how many were copied. The list itself stays on the page; nothing is saved to disk or sent to any server.
The output panel shows a red message asking you to select at least one type, and no passwords are produced until a group is re-enabled.
This tool produces character strings only. If you want memorable diceware-style word sequences, a dedicated passphrase generator or a password manager with that feature is the better fit.
Because the badge counts rubric points, not entropy. A 20-character digits-only password carries roughly 66 bits yet scores Medium, while a 12-character password using all four groups holds about 78 bits and rates Strong. When the badge and the math disagree, trust the math: length and pool size determine the search space, and the badge only checks that policy boxes are ticked.
The clipboard is a poor vault. Other open tabs can read it, third-party extensions can watch it, and its contents linger well after the confirmation toast fades. Paste the batch straight into a password manager's import dialog or an encrypted file, then copy an unrelated phrase to overwrite the buffer.
Random strings suit credentials nobody needs to memorize — service accounts, API tokens, database passwords, and master passwords stored in a manager. For passwords you type often or read aloud, a 20-character random string is a liability; a long passphrase or the manager's autofill is friendlier and still strong. The generator's job ends at the browser tab: the produced secrets live in the output panel and the clipboard until you file them somewhere, so move each one into a password manager before closing the page. Treat every output as disposable: when a service announces a breach, regenerate that account's credential instead of lengthening the old one, and never reuse the same string across two accounts.