Password Generator
Generate strong random passwords in your browser.
—Generated entirely in your browser — never sent to a server or put in the URL.
Quick answer
Password Generator creates strong, random passwords entirely in your browser, so the generated password is never sent to a server. Adjust the length and character types (uppercase, numbers, symbols) to match a site's requirements.
This Password Generator builds strong, random passwords entirely in your browser using the browser's cryptographic random number generator. Nothing is sent to a server, logged, or stored, so the password you see never leaves your device. It is handy when you need a fresh credential for a new email account, a database user, an SSH key passphrase, or a Wi-Fi network, and you want something far harder to guess than a name-and-number combination. You control the length and which character sets are included, then copy the result straight into your password manager.
How it works
The tool draws each character from the sets you enable (lowercase, uppercase, digits, symbols) using window.crypto.getRandomValues, which is a cryptographically secure source rather than Math.random. Every character is picked independently, so the output has no predictable pattern. Increasing the length or adding character sets raises the entropy, meaning the number of possible combinations an attacker would have to try. A 16-character password mixing all four sets already reaches a range that is impractical to brute-force.
How to use it
Pick a length of at least 16 characters for important accounts, and enable every character set the target system accepts. Generate, then copy the password directly into your password manager instead of typing it by hand. If a service rejects certain symbols, turn off the symbol set and add a few characters to length to keep the strength. Generate a new password per account, never reuse one, and store each in a manager rather than a note file.
Why it matters
Most account breaches come from reused or guessable passwords, not from cracking strong ones. A unique random password per service means a leak from one site cannot unlock the others, which stops credential-stuffing attacks cold. Because the generation happens locally, there is no network round trip that could expose the value in transit or in server logs. Pairing these passwords with two-factor authentication gives you a solid baseline for account security.
Frequently asked questions
- Are the passwords really random and safe to use?
- Yes. The generator uses the Web Crypto API (crypto.getRandomValues), the same secure random source browsers use for cryptographic operations, not the predictable Math.random. Each character is chosen independently. As long as you use adequate length and multiple character sets, the output is suitable for real accounts, encryption keys, and SSH passphrases.
- Does the password get sent anywhere or saved?
- No. Generation runs entirely in your browser with JavaScript. The password is never transmitted to any server, written to a database, or kept after you close the tab. That is why you should copy it into your password manager immediately, since the tool itself deliberately keeps no record of what it produced.
- How long should my password be?
- For most online accounts, 16 characters mixing upper case, lower case, digits, and symbols is a strong, practical choice. For high-value targets like password-manager master passwords or encryption keys, go to 20 or more. Length adds more strength than complexity, so when symbols are not allowed, compensate by increasing the character count.