Generate a random password with crypto.getRandomValues and rejection sampling, so there is no modulo bias. Length is 8 to 64 characters; look-alikes can be excluded. Entropy is shown live as length × log2(alphabet). A 16-character password over 70 symbols is about 98 bits. Nothing is stored or sent.
Runs in this tab · nothing is uploaded · Verify in 10 seconds →
This generator builds passwords from cryptographically secure randomness, with toggles for lowercase, uppercase, digits and symbols, a length from 8 to 64 characters, and an option to drop look-alike characters (0, O, 1, l, I, |) for passwords someone might read aloud or type by hand. Use it whenever a site or system needs a fresh credential you will store in a password manager.
Every character index is drawn with crypto.getRandomValues, using rejection sampling: random 32-bit draws that fall in the final partial cycle of the alphabet size are discarded, so every character is exactly equally likely, the naive value % size approach would subtly favor the start of the alphabet. The entropy readout is length × log₂(alphabet size), computed from the character sets you currently have enabled. Generation happens in this tab; nothing is stored, logged or transmitted.
Length 8–64.
~/faq
With all four character sets enabled the alphabet has 90 characters, so each character contributes log₂(90) ≈ 6.49 bits and 16 characters give about 104 bits of entropy, far beyond what offline guessing attacks can search.
Length. NIST SP 800-63B recommends supporting long passwords rather than enforcing composition rules like "one symbol and one digit", because entropy grows with every added character. Four extra lowercase-only characters add more entropy than swapping a letter for a symbol.
It removes 0, O, 1, l, I and | from the alphabet, shrinking it from 90 to 84 characters. At 16 characters that drops the entropy from about 104 to about 102 bits, a negligible price for a password a human has to read or retype.
Mapping a random 32-bit number onto a 90-character alphabet with a plain modulo makes the first characters of the alphabet very slightly more likely, because 2³² is not a multiple of 90. Rejection sampling throws away draws from the incomplete final cycle, so the distribution is exactly uniform.
No. Passwords exist only in this tab's memory until you regenerate or close it. There is no history, no analytics on the values, and no network request involved in generating or copying them.
Colored strength bars guess at human password patterns; for randomly generated passwords the entropy number is the honest measure. Anything above roughly 80 bits is beyond realistic offline attack, and the readout updates live as you change length or character sets.
Chosen for the same job, not just the same category.