How strong is a generated password?

A 16-character password drawn from 94 ASCII printable characters has ~105 bits of entropy. Bcrypt-protected at the server, this would take an attacker billions of years to crack via brute force. Anything above 80 bits is considered strong; 60+ is acceptable.

Why use this instead of letting my browser pick one?

Browser-generated passwords are also strong — this is for cases where you need it outside a form (a sysadmin generating service-account passwords, a developer adding a credential to a config file) or want explicit control over the character set.

What's a 'similar character'?

0/O, 1/l/I, 5/S — characters that look alike in many fonts. Excluding them sacrifices a few bits of entropy for much easier visual / verbal transcription. Worth it for passwords you'll dictate or type from memory.

crypto random · entropy · char sets · local

Generate strong passwords

Q: Is anything sent to a server?

No — generation uses your browser's cryptographic RNG. The password never leaves the page.

Cryptographically random passwords with adjustable length and character sets. Live entropy meter tells you how strong each one is. Runs locally.

Password Generator

Length

chars

Alphabet

size

Entropy

129 bits

very strong

Status

—

crypto

output · password

—

Entropy

129.2 bits

Strength

very strong

Quick Start

How password generation works

Each character is sampled from your alphabet using crypto.getRandomValues — never Math.random. Entropy = length × log2(alphabet size).

01
Pick length
16+ for most uses, 32+ for master passwords.
Inputs are treated as UTF-8 throughout the pipeline and validated client-side as you type — nothing dispatches until the value is well-formed.
leninpututf-8client-sidevalidated
len · text20 · set
```
20 chars
```
loaded · parsedclient-side
02
Choose char sets
Uppercase, lowercase, digits, symbols — each adds entropy.
Each toggle re-computes through a memoised hook, so flipping options never resets your input and the UI stays snappy on large inputs.
setoptionslivememoisedtoggles
set · memoisedAa1! · live
```
94 chars
```
options set · memoisedlive
03
Exclude lookalikes
Drops 0Oo1Il so passwords print clearly.
Randomness — where used — comes from crypto.getRandomValues, never Math.random. Heavy work sits in useMemo.
readablecomputeinstantlocaldeterministic
ex · instantoff · computed
```
0/O kept
```
computed · instantinstant
04
Copy & vault it
Save straight to your password manager.
Copy writes through navigator.clipboard and downloads use a Blob — zero network traffic. Same input plus same options always yield the same bytes.
savecopydownloadzero-networkreproducible
ok · copiedready · copied
```
Copied
```
shipped · ready to shipsuccess

Pro tips

Pro tips for everyday utilities

Reach for crypto.getRandomValues

Cryptographically random for IDs, tokens, salts. Math.random is for animation and games, not security.

Sort IDs lexicographically

UUID v4 has no time ordering. Use ULID or UUID v7 if you need sorted IDs.

Mock data with seeds

Faker-style libraries can be seeded so tests are reproducible. Embed the seed in the fixture file.

Reference cards beat memory

Cheatsheets for Vim, Git, Docker, Linux signals are faster than man pages when you’re mid-flow.

Browser APIs vary

Touch events, gamepads, and clipboard differ across vendors. Feature-detect before use.

Persist in the right place

localStorage for user preferences, sessionStorage for transient state, IndexedDB for structured data.

Use Cases

When to generate a password

New accounts, API keys, service creds.

New accounts

Unique high-entropy password per site. Random values come from crypto.getRandomValues — cryptographically secure for tokens, salts, and session IDs. Math.random is deterministic enough for animations but predictable enough to be a security bug.

CSPRNG-backed

Service credentials

DB users, cron tokens, machine accounts. Pair with hashids, ULID, or UUID v7 when you need both random and sortable — useful for primary keys, public-facing IDs, and event log ordering without a sequence column.

reproducible

Reset flows

Generate something memorable-strong on rotation. Output is deterministic given the same seed, so fixtures and tests stay reproducible across CI runs and contributor machines. Embed the seed in the fixture file for full replay.

snappy

Test fixtures

Realistic strings for password validation tests. Heavy work runs through useMemo so the UI stays snappy on large inputs. Same input + same options yields identical bytes — the kind of stability snapshot tests rely on.

feature-detected

Time-limited keys

Short tokens for quick-expire shares. Storage tools persist to the right backend: localStorage for user preferences, sessionStorage for transient state, IndexedDB for structured data. Pick the right shelf and quota worries disappear.

deterministic

Cross-team handoff

Same alphabet, no policy surprises. Browser feature detection: clipboard, fullscreen, gamepad, and Web Bluetooth APIs gracefully fall back when unavailable. No surprise white screens on Safari or older Firefox.

production-ready

FAQ

Frequently asked questions

Is it really random?

Yes — we sample from crypto.getRandomValues, which uses the OS RNG. Math.random is never called for password bytes.

Modulo bias?

We use a Uint8Array modulo the alphabet. With 26-94 char alphabets the bias is below noise floor for any reasonable length.

Why exclude similar?

Useful for passwords you'll print or read aloud — 0/O and 1/l/I are visually ambiguous.

Where should I store it?

A password manager — never plain text. Even sticky notes beat reuse.

Is anything sent to a server?

No. Passwords never leave your browser.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!