Random passwords via Web Crypto, on your device. Nothing is uploaded.
The Password Generator draws every character with crypto.getRandomValues; a 16-character password over a 70-symbol alphabet carries about 98 bits of entropy, and nothing is sent over the network.
This generator builds passwords from cryptographically secure randomness, with toggles for lowercase, uppercase, digits and symbols, a length from 8 to 64 characters, and an option to drop look-alike characters (0, O, 1, l, I, |) for passwords someone might read aloud or type by hand. Use it whenever a site or system needs a fresh credential you will store in a password manager.
Every character index is drawn with crypto.getRandomValues, using rejection sampling: random 32-bit draws that fall in the final partial cycle of the alphabet size are discarded, so every character is exactly equally likely — the naive value % size approach would subtly favor the start of the alphabet. The entropy readout is length × log₂(alphabet size), computed from the character sets you currently have enabled. Generation happens in this tab; nothing is stored, logged or transmitted.
No. This page never sends your input to a server — formatting, decoding and hashing all run in this tab, on this device.How that works.
With all four character sets enabled the alphabet has 90 characters, so each character contributes log₂(90) ≈ 6.49 bits and 16 characters give about 104 bits of entropy — far beyond what offline guessing attacks can search.
Length. NIST SP 800-63B recommends supporting long passwords rather than enforcing composition rules like "one symbol and one digit", because entropy grows with every added character. Four extra lowercase-only characters add more entropy than swapping a letter for a symbol.
It removes 0, O, 1, l, I and | from the alphabet, shrinking it from 90 to 84 characters. At 16 characters that drops the entropy from about 104 to about 102 bits — a negligible price for a password a human has to read or retype.
Mapping a random 32-bit number onto a 90-character alphabet with a plain modulo makes the first characters of the alphabet very slightly more likely, because 2³² is not a multiple of 90. Rejection sampling throws away draws from the incomplete final cycle, so the distribution is exactly uniform.
No. Passwords exist only in this tab's memory until you regenerate or close it. There is no history, no analytics on the values, and no network request involved in generating or copying them.
Colored strength bars guess at human password patterns; for randomly generated passwords the entropy number is the honest measure. Anything above roughly 80 bits is beyond realistic offline attack, and the readout updates live as you change length or character sets.
Browse allgeneratorsor thefull tool directory.