Security & Encoding
Secure Password Generator
Generate a cryptographically secure password with configurable length and character rules. Everything runs in your browser — your password is created on your device and is never sent anywhere.
Generated password
20 charactersVery strong
How it works
Characters are drawn from your browser’s crypto.getRandomValues() source
using rejection sampling, so the output avoids the modulo bias of a plain
Math.random() generator. When “require one of each set” is on, the
password is seeded with one character from every selected set and then shuffled with a
secure Fisher–Yates pass. Nothing is uploaded, no request is made, and the settings
link stores only your rules — never the password itself.
Practical uses
Create a random password from your browser's cryptographic random source, with length and character rules you control.
Common ways to use it
- Generate a one-off password for a new account or a Wi-Fi network.
- Satisfy a sign-up form that requires upper-case, lower-case, digit and symbol characters.
- Produce a longer random string for a password manager entry.
20 characters with all four sets
Input
Length: 20 Lowercase + Uppercase + Digits + Symbols Require one of each set: on
Output
Length: 20 characters Pool: 86 characters (79 with similar characters excluded) Guaranteed: at least one lower-case letter, upper-case letter, digit and symbol Entropy: about 129 bits — rated "Very strong"
A fresh random password is produced each time, so no fixed string is shown. These figures come from the tool's own pool and entropy functions. A generated password is for one use; do not reuse or share it.
Options that matter
- Length — 4 to 64 characters; longer passwords take far longer to guess.
- Character sets — lowercase, uppercase, digits and symbols.
- Require one of each set — seeds one character per selected set, then shuffles.
- Exclude similar characters — removes i l 1 L I 0 O, reducing the pool from 86 to 79.
Things to keep in mind
- The entropy estimate is based only on length and pool size; it does not check a password against breach lists or dictionary patterns.
- Generated passwords are never sent anywhere, and the share link stores only your rules, never the password.
- If a browser has no secure random source the page warns that it has fallen back to Math.random, which is weaker.