Password Generator
Generate a random password of 8 to 128 characters in your browser with Web Crypto: uniform draw, exact entropy and optional exclusion of ambiguous characters.
Choose the length and the character types: a password is drawn in your browser, without bias, and you can then copy it into your password manager.
Input
Generation only happens in your browser and requires JavaScript.
Results
The password is generated in your browser.
Generated password
Entropy measures the tool’s random draw, not a password chosen by a person.
Copying only happens when you click Copy. The clipboard is available to other applications and may be kept in a history or synced across your devices.
Local generation and its limits
The password is generated in your browser with the Web Crypto API; this tool’s code does not send or store it. As on any web page, third-party scripts, including advertising, and browser extensions can technically read what is displayed. For a critical secret, preferably use your password manager’s generator.
Using the generator
How the password is drawn
Each character is drawn with crypto.getRandomValues, the browser’s cryptographic random source, without bias: every password allowed by your options is equally likely. With the “at least one character of each type” option, a password missing a type is discarded and a whole new password is drawn.
Reading the entropy
Entropy, in bits, is the base-2 logarithm of the exact number of passwords your options allow: 20 characters out of the 94 available give about 131 bits. It measures the tool’s draw, not a password chosen by a person.
Local generation and its limits
The tool’s code does not send or store the password: no request, no cookie, no storage, nothing in the page address. The password does not exist in the page served by the server; it only appears in your browser. This page does, however, load Google’s advertising script, which runs with the same rights as the rest of the page; we do not control its behaviour, nor that of your extensions. Local generation therefore reduces exposure without guaranteeing complete confidentiality. The display is cleared when you leave the page, but a web page cannot reliably erase the browser’s memory.
Clipboard and good practice
Copying only happens when you click Copy. The clipboard is available to other applications and may be kept in a history or synced across your devices: paste the password into your manager, then copy something else. Use a different password for each service and turn on multi-factor authentication where it is offered.
Frequently asked questions
What length should I choose?
The suggested value, 20 characters out of 94, gives about 131 bits of entropy, ample for an online account. Make the password longer if a service limits the character types it accepts.
What is the exclusion of ambiguous characters for?
It removes 0, O, o, 1, I, l and |, which are easy to confuse when reading or typing by hand. The alphabet goes from 94 to 87 characters: entropy drops slightly, and the indicator accounts for it.
Does requiring each character type weaken the password?
Very little: only passwords that would miss a type are discarded. For 20 characters, entropy goes from about 131.1 to 130.9 bits. The draw stays uniform among the remaining passwords.
Is the password sent to a server?
Not by the tool’s code: it is drawn in your browser and is neither transmitted, stored nor placed in the page address. It does not exist in the page served by the server.
Does local generation hide the password from the page?
No. Any script loaded by the page, including advertising, can read its content. The tool’s code does not transmit the password and limits how long it is displayed, but we cannot guarantee the behaviour of scripts we do not control.
Why recommend a password manager?
A manager remembers a different password for each service and types it for you. Its own generator also avoids going through a web page and the clipboard: prefer it for a critical secret.