A password generator that actually uses cryptographic randomness
A lot of simple password generators quietly use JavaScript's basic Math.random() function — fine for a casual dice roll, genuinely unsuitable for something meant to be unpredictable enough to resist a determined guess. This tool uses the Web Crypto API instead, the same cryptographically secure randomness source browsers rely on for encryption itself, and generates every password directly in your browser with nothing ever transmitted anywhere.
Using it
- Set the length — longer is generally stronger.
- Choose which character types to include: lowercase, uppercase, numbers, symbols.
- Copy it, or generate a fresh one instantly with the same settings.
Why length beats complexity
It's a common misconception that a short password stuffed with symbols is safer than a longer, simpler one. In practice, each additional character multiplies the number of possible combinations an attacker would need to try — length increases that search space far more dramatically than a few extra symbols do. A random 16-character password is, in almost every practical sense, much harder to crack than an 8-character one, even when the shorter one looks more "complicated" at a glance.
Advantages and limitations
Advantages
- Uses genuine cryptographic randomness, not a basic RNG
- Nothing generated is ever transmitted or logged
- Full control over length and character types
- No account, no limit on how many you generate
Limitations
- Doesn't store or manage passwords for you — that's a password manager's job
- Can't guarantee a specific site's exact password rules are met
- A strong password alone doesn't protect against phishing or reuse
One strong password isn't enough on its own
Generating a great password here solves one part of the problem — the harder part is having a genuinely different one for every account, since a breach at one service shouldn't put your other accounts at risk too. Most people solve this with a password manager, which securely stores generated passwords behind one master password you actually remember. This tool is meant for creating the individual passwords a manager would then store — not for remembering them yourself.
Nothing generated is ever stored
Because everything happens locally, this tool has no record of any password it's ever generated. See our Privacy Policy for full details.
Frequently asked questions
+Is this password generator really free, with no sign up?
Yes. There's no account and no limit on how many passwords you can generate.
+Is it actually safe to generate a password on a website?
It depends entirely on how the site does it. This tool generates every password using the Web Crypto API — the browser's own cryptographically secure random number source, the same one used for security-sensitive operations elsewhere in the browser. Nothing is transmitted, logged, or stored, including by us.
+What's the actual difference between this and Math.random()?
Math.random(), which many simpler password generators use, is designed for speed and general-purpose randomness — not security. It's mathematically predictable given enough output, which makes it a poor fit for something like a password. The Web Crypto API this tool uses is specifically designed to be unpredictable, the same standard used for encryption keys.
+How long should my password actually be?
Longer matters more than most people expect — more than adding a few extra symbol characters to a short password. A random 16-character password is dramatically harder to guess or crack than an 8-character one, even if the shorter one looks more "complicated" with symbols mixed in.
+What does the strength indicator actually measure?
It estimates entropy — roughly, how many possible combinations an attacker would need to try — based on your password's length and which character types are included. It's a reasonable guide, not a guarantee against every possible attack method.
+Should I reuse a strong password across different accounts?
No — even a genuinely strong password should be unique per account. If one service is ever breached, a reused password lets an attacker try it elsewhere too. A password manager is the standard way to track many unique passwords without memorizing them all.