About this tool
Reused or predictable passwords are one of the most common causes of account compromise. This generator creates random passwords using the Web Crypto API's cryptographically secure random number generator, directly in your browser — the password is never transmitted or logged anywhere.
How to use it
- 1Set your desired password length using the slider.
- 2Choose which character types to include: lowercase, uppercase, numbers, and symbols.
- 3Optionally exclude ambiguous characters (like l, 1, O, 0) if the password will be typed by hand.
- 4Click "Regenerate" for a new password, or "Copy" to copy the current one.
Common mistakes to avoid
- Using a short password (under 12 characters) even with all character types enabled — length matters more than complexity.
- Reusing the same generated password across multiple accounts instead of using a password manager to store unique ones.
- Excluding symbols entirely, which meaningfully reduces the character pool and weakens the password against brute-force attacks.
Use cases
- Creating a new account password that meets a site's complexity requirements.
- Generating a one-off password for a shared or temporary account.
- Rotating an old, weak, or potentially compromised password.
- Generating API keys or secrets for local development and testing.
Frequently asked questions
Is this password generator secure?
Yes. It uses crypto.getRandomValues(), the Web Crypto API's cryptographically secure random number source, rather than Math.random(), which is not suitable for security-sensitive values.
Are generated passwords stored or sent anywhere?
No. Password generation happens entirely in your browser's memory. Nothing is transmitted to a server or stored after you close or refresh the page.
What password length should I use?
For most accounts, 16 characters or more with a mix of character types is a strong baseline. Use a password manager so you never have to remember or reuse passwords.