Password Generator

This tool uses the Web Cryptography API's crypto.getRandomValues() method, which is seeded by the operating system's cryptographically secure pseudorandom number generator (CSPRNG) - the same entropy source used by professional password managers. Each character is selected with uniform probability from your chosen character set, so there is no statistical bias that an attacker could exploit. This approach is fundamentally different from Math.random(), which is not cryptographically secure and should never be used for password generation.

No data ever leaves your browser. Password generation happens entirely in client-side JavaScript, meaning no network request is made and the generated strings are never transmitted to or stored on any server. You can verify this by turning off your internet connection and using the tool - it will continue to work perfectly. This makes it safe to generate passwords for sensitive accounts without any risk of interception.

Security experts and NIST guidelines recommend passwords of at least 16 characters for general accounts and 20+ for high-value targets like email, banking, or password managers. Using all four character sets (uppercase, lowercase, digits, symbols) maximizes entropy - a 20-character password from the full 94-character ASCII printable set has roughly 131 bits of entropy, making brute-force attacks completely infeasible with current hardware. If a service prohibits certain symbols, simply uncheck the symbols option; the tool will adapt the character pool accordingly.

Dedicated password managers go further by also storing, auto-filling, and syncing your passwords securely across devices - features this web tool does not provide. However, the underlying generation algorithm is equivalent: both use a CSPRNG with the same level of randomness. This tool is ideal when you need a quick password without installing software, when generating bulk passwords for seeding test data, or when you want a transparent, auditable open tool without an account or subscription.

The tool relies on the Web Cryptography API (crypto.getRandomValues) and the Clipboard API, both of which are supported in all modern browsers - Chrome, Firefox, Safari, and Edge - on desktop and mobile. The Web Crypto API has been available since Chrome 37, Firefox 34, and Safari 11, so any device updated in the last several years will work without issues. On older or restricted browsers that lack Clipboard API support, the generated password will still display and can be selected and copied manually.