Password Generator

Create strong random passwords with your choice of length and character sets. Generated with cryptographic randomness, entirely inside your browser.

password-gen · runs locally
128bits entropy
85character pool
Very strongstrength

Cryptographic randomness, without modulo bias

This generator draws bytes from crypto.getRandomValues, the same CSPRNG your browser uses for TLS — not Math.random(), which is predictable and unsuitable for secrets. It also applies rejection sampling: a random byte has 256 possible values, and if you naively take byte % poolSize, characters early in the pool come up slightly more often. Instead, bytes above the largest exact multiple of the pool size are discarded and redrawn, so every character is chosen with precisely equal probability. Many quick online generators skip this step.

The entropy readout is simply length × log2(pool size) — the honest measure of how many guesses a brute-force attacker needs. Excluding ambiguous characters (0/O, 1/l/I) shrinks the pool slightly, which the readout reflects; it is worth it for passwords someone may have to read aloud or retype.

How to generate a strong password

  1. Pick a length — 16+ for accounts, 24+ for anything critical.
  2. Keep all four character sets enabled unless a site forbids symbols.
  3. Click Regenerate until you have one, then copy it straight into a password manager.

Passwords are secrets; identifiers are not

Use this tool for credentials, API secrets and encryption passphrases. If you only need a unique identifier — a database key or request ID — a UUID is the right tool: unique by construction, but never meant to be secret. And remember that services should store only a hash of your password, never the password itself.

Frequently asked questions

How long should a password be?

For anything important, 16 characters or more with mixed character sets — that puts you above 90 bits of entropy, beyond realistic brute-force range. The 20-character default here yields roughly 130 bits. Length matters more than clever substitutions: every extra character multiplies the search space.

Are the generated passwords sent anywhere?

No. Passwords are generated by your browser's own crypto.getRandomValues API, on your device, and never transmitted, logged or stored. You can load the page, disconnect from the internet, and it will keep generating — nothing here talks to a server.

What actually makes a password strong?

Unpredictability, measured in bits of entropy: the number of equally likely possibilities an attacker must search. A truly random 16-character password from a 90-symbol pool has about 104 bits. Human-invented passwords score far lower than they look because people reuse patterns, dictionary words and predictable substitutions.

Should I use a random password or a passphrase?

Both are sound if generated randomly. Random character strings pack the most entropy per character and belong in a password manager; passphrases of 5–6 random words (Diceware-style) reach similar strength while staying memorable, which suits the few passwords you must type from memory — like the manager's own master password.

UUID Generator

Generate random UUID v4 identifiers — one or hundreds at a time, cryptographically random.

Open tool →

SHA Hash Generator

Compute SHA-1, SHA-256, SHA-384 and SHA-512 hashes of any text.

Open tool →

Base64 Encode / Decode

Encode text to Base64 or decode Base64 back to text. Full UTF-8 support.

Open tool →