Password generator

This tool builds random passwords from character classes you choose: lowercase, uppercase, digits, and symbols. Set a length, pick which classes to include, and optionally exclude ambiguous characters like 0, O, 1, l, and I that are easy to misread on a screen or a printed card. Generate one password or a hundred at once.

How random are the passwords?

Every character is picked with the Web Crypto API’s crypto.getRandomValues(), the same source browsers use for cryptographic keys, not Math.random(), which isn’t designed to be unpredictable. Picking a random character from a pool that isn’t a power of two is trickier than it sounds: naively taking a random byte modulo the pool size skews the result toward some characters. This tool avoids that with rejection sampling, drawing random bytes and discarding any value that would land outside a clean multiple of the pool size, so every character in the pool ends up equally likely. The characters are then shuffled with a Fisher-Yates shuffle driven by that same random source, after first guaranteeing at least one character from every class you selected, so a password with all four classes turned on is never accidentally missing a symbol. The entropy readout shows how many bits of randomness a password has, calculated as length times log2 of the pool size, and gives a quick way to compare settings before generating.

Is my password sent anywhere?

No. Password generation happens entirely in your browser using the Web Crypto API, and nothing about the result, the settings you chose, or the password itself is sent to a server, logged, or stored anywhere. That’s what makes it safe to use for real account passwords rather than only test data: a tool that generated passwords server-side would need you to trust that it never records them, and this one removes that question by not talking to a server at all.

What is this useful for?

Common uses include new account signups, database or service credentials, API keys and shared secrets, or a batch of throwaway passwords for test accounts. If you turn off every class except one, or set a length shorter than the number of selected classes, the tool will tell you rather than silently generating something weaker than you asked for. See NIST SP 800-63B for current password guidance and MDN’s Crypto.getRandomValues() reference for how the underlying randomness is produced.