Password Generator Online Free
Generate a strong, random password in one click. Set the length and character types, then copy it.
How this password generator sources randomness, and why that choice actually matters
The single most important fact about any password generator is where its random numbers come from, and this one gets it right. Every password, PIN, passphrase and memorable string this tool produces is built using crypto.getRandomValues, the Web Crypto API’s cryptographically secure random number source, not Math.random. That distinction is not academic. Math.random is a fast, statistically decent generator meant for things like animation timing, but its underlying algorithm is not designed to resist prediction, and in some browser engines its internal state has been reconstructed from a handful of observed outputs. crypto.getRandomValues draws from the operating system’s cryptographic random source, the same class of generator used to create TLS session keys.
Every character selection in every mode calls this one function. Nothing about your generated password is transmitted anywhere, computed on a server, or logged. The whole thing runs in the tab and disappears when you close it.
The four generation modes
0, O, 1, l, I, plus any custom characters you exclude. It draws the password randomly from that pool, then forces inclusion of at least one character from each selected type by overwriting a random position for each, guaranteeing composition requirements without biasing which position holds which type.
How the entropy figure is calculated
The strength meter scans the generated password character by character and detects the largest applicable pool size: 26 for lowercase only, 52 once uppercase joins in, 62 once digits appear, 94 if a symbol shows up. Entropy in bits is then length times log base 2 of pool size, the standard formula for a uniformly random string drawn from a fixed alphabet. A 16-character password using all four character types lands around 105 bits under this formula, comfortably into the tool’s Very Strong band.
| Entropy (bits) | Label | What it means practically |
|---|---|---|
| Under 28 | Very Weak | Guessable in a trivial online attack |
| 28 to 39 | Weak | Falls to an offline dictionary or hybrid attack quickly |
| 40 to 59 | Fair | Resists casual attacks, weak against dedicated hardware |
| 60 to 79 | Strong | Impractical to brute force with consumer GPU hardware |
| 80 and above | Very Strong | Effectively unbreakable by brute force with current hardware |
secRand(n) computes arr[0] % n against a 32-bit random integer. When n does not evenly divide 2 to the 32, outcomes near the low end of the range become fractionally more likely than outcomes near the top, a well-known issue with modulo-based bounding. For a symbol pool of around 90 characters against a 32-bit source, the bias is on the order of one part in fifty million, far below anything a practical attack could exploit, but it is not the textbook-perfect rejection-sampling approach a formal cryptographic library would use.Two smaller details worth knowing
History is in-memory only
The last five generated passwords are kept in a local JavaScript array so you can click back to a previous result, but this list is never written to localStorage or any persistent storage. Refresh the page and it’s gone.
Batch generation reuses the same logic
Generating multiple passwords at once simply calls the same secure generation function in a loop, each one an independent draw with no relationship to the others.
- W3C Web Cryptography API specifies
getRandomValuesand requires it to be backed by a cryptographically secure pseudorandom number generator. - NIST SP 800-63B is the current US digital identity guideline, notable for de-emphasising forced complexity rules in favour of length and blocking known-breached passwords.
- EFF’s Diceware wordlists are the larger, more rigorously curated word sets that inspired the passphrase mode here.
- MDN getRandomValues reference explains exactly why
Math.randomshould never be used for anything security-sensitive.
Building a password you can trust
Generating a fresh password for a new account signup, creating a memorable passphrase for a password manager’s master password, producing a numeric PIN for a device lock screen, batch generating credentials when provisioning several service accounts at once, and replacing a reused or weak password flagged by a breach notification service.
Questions About Password Generator Online Free
Yes. It uses the Web Crypto API’s getRandomValues() function. Passwords are generated locally and never leave your browser.
At least 16 characters for regular accounts. Use 20 or more for important accounts like email and banking.
!@#$%^&*()-_=+[]{}|;:,.<>? are included when symbols are turned on.
Yes. Using the same password on multiple accounts means one breach can compromise all of them.
In a password manager like Bitwarden, 1Password or Dashlane. Do not store it in a plain text file or email.
From the blog
Security writing without the scare tactics
Practical explanations of hashing, headers, certificates and consent, aimed at people who have to ship something this week.
