Password Generator
Generate strong random passwords with the browser's cryptographic random source. Lookalike characters excluded, entropy shown, nothing transmitted.
Private by construction. The conversion happens in this page's JavaScript. Nothing you paste here leaves your machine, and the tool keeps working with the network unplugged.
Five candidate passwords per click, generated with crypto.getRandomValues() — the browser's cryptographically secure source, with rejection sampling so no character is statistically favored (the classic modulo-bias bug in naive generators). Lookalike characters (I l 1 O 0) are excluded, because a password you cannot retype from a screen is a password you will weaken by hand. The entropy line does the honest math: length × log₂(alphabet size). Aim for 75+ bits on anything that matters. Generated passwords exist only in this tab; the only copy is the one you take.
Questions this tool gets asked
How random are these really?
They come from the Web Crypto API, the same secure random source browsers use for TLS key material, with rejection sampling to remove modulo bias. Generators built on Math.random() are predictable and unsuitable for passwords.
What length should I use?
16 characters is a sensible floor for accounts that matter; 20+ costs you nothing when a password manager does the remembering. The entropy line tells you exactly what each length buys.
Why are I, l, 1, O and 0 missing?
They are visually ambiguous in most fonts. Removing them costs about 0.1 bits of entropy per character and eliminates the most common transcription errors - a trade every good generator makes.
Should I use a password or a passphrase?
For anything typed by hand regularly, a diceware-style passphrase is kinder to memory. For everything stored in a password manager - which should be nearly everything - random strings like these are denser and stronger per character.