What this tool does
This generator produces passwords from the length and character sets you pick, up to 50 at a time. Randomness comes from the browser cryptographic source, and the results never leave your device or get recorded anywhere.
Why not invent a password yourself? Because human choices drift toward memorable patterns — capitalised first letter, a trailing year, adjacent keyboard keys — and those are exactly the patterns cracking tools try first. Pure random selection removes that structure.
How to use
- Step 1: choose a length Sixteen characters is a solid default for everyday accounts. For a master password or an encryption passphrase go to 24 or more. If a legacy system caps you at 8–12, use the maximum and enable every character set.
- Step 2: pick character sets Letters and digits are on by default while symbols are off, because plenty of sites either reject symbols or silently truncate passwords. Turn symbols on when the target site allows them, and strength rises noticeably.
- Step 3: copy and use it Use Copy to paste it into the signup form, and save it in your password manager at the same time. Generating a few candidates at once saves a round trip when the first one trips a site rule.
Limits
The ceiling is 128 characters and 50 passwords per run; exceeding either gives a clear error rather than a silent truncation. Results are plain text and never persisted: a reload regenerates them and closing the tab loses them — save to your password manager first. Strength scoring, diceware passphrases and autofill are out of scope.
FAQ
Are these passwords actually random?
Yes. Values come from crypto.getRandomValues — the operating system cryptographic source, not Math.random — and rejection sampling keeps every character equally likely instead of favouring the first few.
How long should a password be?
Sixteen characters covers everyday accounts at roughly 95 bits; use 20–24 for email, cloud storage or a password-manager master password. Extra length pays off linearly and is worth more than stacking more symbol types.
Why exclude look-alike characters?
Zero versus O and one versus l or I look identical in many fonts. When you have to retype a password on another device — a TV, console or router admin page — removing them cuts typos and account lockouts.
Are generated passwords stored?
No. Generation and display happen in the page: nothing containing the values is sent, and nothing is written to local storage. Open the Network panel if you want to confirm it yourself.
Do I need symbols?
Not strictly. Symbols lift the alphabet from 62 to roughly 87, worth about 8 extra bits at length 16 — but spending the same effort on length (16 → 20) buys more and never trips a site rule.
Can I use it for API keys or passphrases?
You can, with two caveats: prefer the provider-supplied key when an API offers one, and use at least 24 characters for an encryption passphrase — and never reuse the same passphrase across systems. The AES tool here can confirm a passphrase and ciphertext work together.