Online secure password generator: customizable length, uppercase, lowercase, numbers, symbols. Uses crypto.getRandomValues for true randomness. Generated locally, never stored.
TL;DR: Free secure password generator using crypto.getRandomValues for true randomness. Customizable length, uppercase, lowercase, numbers, and symbols. Generated locally, never stored or uploaded.
For local tools, open DevTools → Network and search your input — it should not appear in requests.
Next steps
Usage Guide
Generate strong passwords or passphrases from your browser's cryptographic random source (Web Crypto API): length and character-set controls, exclude-confusing-chars, batch generation, a live strength meter, plus a Diceware-style word-phrase mode. Everything stays local — close the tab and the password never existed anywhere.
1. Generate a batch of strong passwords
- Drag the length slider (default 16).
- Check character classes: uppercase, lowercase, digits, symbols — keep at least three.
- Click generate; batch mode suits pre-provisioning team accounts before each member rotates theirs.
- Copy, and glance at the strength bar below.
2. How long is enough
For purely random passwords, strength is a function of length and alphabet size. 16 characters over the full set carries roughly 100 bits of entropy — brute-forcing at current compute takes millennia; a fair baseline for important accounts. 8 characters with symbols is only ~50 bits — a GPU cluster needs days. When a site caps password length, prefer more length over more character classes: a long passphrase like "correct horse battery staple" beats an 8-character gibberish string in both strength and memorability.
3. Two misconceptions worth fixing
- The strength meter is an entropy estimate, not a security guarantee: it bounds brute-force resistance, not phishing or credential-breach exposure — pair important accounts with 2FA.
- A generator is only as safe as its randomness: this tool uses Web Crypto (OS-level CSPRNG); many tutorials use Math.random, a predictable PRNG unsuitable for real passwords.
4. The math behind strength estimation
Password strength is entropy: a random password of length L over a character set of size N has a search space of N^L. Each added character multiplies the space by N (x10 for digits, x90+ for mixed), while doubling the alphabet adds only one bit of equivalent length. That is the quantified case for length over complexity: 16 lowercase letters (26^16 = 10^22) beat 8 fully-mixed characters (~10^15) by a factor of a million. This tool grades along those lines, then downgrades on dictionary hits and known patterns (keyboard walks, repeats, dates) — because an attacker always runs wordlists and rules first, never brute force.
5. Three principles of modern password policy
- Passphrases beat passwords: four random Diceware words carry real entropy and stay memorable, unlike 8 characters of symbol soup.
- Uniqueness outweighs everything: reuse means the weakest site you used leaks all of them — generate per-site via a password manager.
- NIST since 2017: no forced periodic rotation (absent evidence of compromise), no forced special characters; favor long passphrases plus breach-list checking.
6. Passphrase mode and excluding look-alike characters
- When humans must read or type the secret, switch to passphrase mode: random words plus a separator, optional capitalization and trailing digit/symbol — entropy comes from word count, readability beats gibberish.
- Exclude-confusing drops 0/O, 1/l/I and similar glyphs for printouts or phone readbacks; a smaller alphabet slightly lowers entropy, so add length to compensate.
- Custom character sets help when a site bans certain symbols: disable conflicting classes, then paste the allowed symbols into the custom box.
- Batch generation is for distributing initial credentials; force a change on first login — never treat the batch as a long-lived shared secret.
FAQ
Strength depends only on length and alphabet size: 16 characters over the full set give about 100 bits of entropy, putting brute force on a geological timescale, while 8 characters manage only about 50 bits even with symbols. When a site caps length, spend it on length first — 16 lowercase letters (26^16 ≈ 10^22) are about a million times stronger than 8 full-set characters (~10^15). Length beats complexity, and the math says so.
This tool draws from the Web Crypto API — the operating system's cryptographically secure random source. The Math.random approach seen in many tutorials is predictable pseudo-randomness and must never generate real passwords: a generator is only as trustworthy as its entropy source.
The meter is an entropy estimate, not a promise: it gauges brute-force resistance, not phishing or password-database breaches — important accounts still need two-factor authentication. Grading also cross-checks common password dictionaries and patterns (keyboard walks, repeats, dates) and demotes any hit, because an attacker's first pass is always dictionaries and rules, never raw brute force.
Passphrase mode chains random words with a separator — entropy grows with word count — and suits anything you must read aloud or memorize, with optional capitalization and appended digits or symbols. Exclude-look-alike drops 0/O and 1/l/I for printouts or phone dictation; compensate the smaller alphabet with extra length. When a site bans certain symbols, paste the allowed ones into the custom character set. Batch generation is only for issuing initial passwords — always force a change at first login.
NIST guidance since 2017: no forced periodic rotation (absent evidence of a breach) and no mandatory special characters — favor long passphrases checked against breach databases. Uniqueness matters more than complexity: reuse one password across sites and the weakest site's leak compromises them all, so generate per-site credentials with a password manager.
No. Passwords are created on your device by the browser's Web Crypto API — nothing is stored or uploaded, and once you close the tab the password exists nowhere. Copy it before you leave.
Related Tools
Related Articles
Password Strength Checker: Evaluate and Improve Passwords
Length, charset, weak-pattern penalties, and effective entropy: check passwords locally in the browser, then link to the generator and bcrypt storage.
Online Password Generator: How to Create Strong, Secure Passwords
Create strong random passwords with a CSPRNG. Length vs complexity, entropy math, manager lifecycle, and how generation pairs with bcrypt storage — not SHA-256 file checks.
Passkeys, Explained: Why the Server Can No Longer Hold a Copy of Your Password
Passkeys (WebAuthn/FIDO2) deepened: registration vs assertion ceremonies, platform authenticators and roaming keys, synced passkeys, how they relate to passwords/TOTP/JWT, and why origin binding makes phishing resistance structural. Servers store public keys only; note that this site has no dedicated Passkey tool page.