Is this actually random, or predictable like Math.random?

It draws every character from your browser's cryptographically secure generator, crypto.getRandomValues, not Math.random. It also picks characters by rejection sampling, so no character is even slightly more likely than another, which makes the output safe for real accounts.

What do the 'bits of entropy' and the strength labels mean?

Entropy is length times log2 of the pool size; the higher the number, the harder the password is to crack. The meter buckets it as weak (under 40 bits), fair (40 to 59), strong (60 to 79), and excellent (80 and up); with all four sets on, a 13-character password already crosses 80 bits.

Which symbols does it use?

The symbol set is !@#$%^&*()-_=+[]{};:,.<>? which is 24 characters. Combined with lowercase, uppercase, and digits, that makes an 86-character pool, so each character contributes about 6.4 bits of entropy.

Will it satisfy a site that requires at least one number and one symbol?

Yes. The generator guarantees at least one character from every set you enable, then shuffles positions so the required characters do not cluster at the front. Just keep the digits and symbols toggles on.

What does 'exclude look-alike characters' remove?

It drops visually confusable characters such as i l 1 L I, 0 O o, B 8, S 5, Z 2, and some quote and bracket symbols, so a password cannot be mistyped when read off a screen. Turn it on for passwords a human will type, and leave it off (a larger pool) for ones a password manager stores.

Can I generate several passwords at once?

Yes, up to 50 in one go: set the count and use Copy all to grab the whole list, or the copy button on any single row. It all happens in your browser with zero network requests, which you can confirm in DevTools under the Network tab.

Password Generator

Create strong random passwords instantly — pick length, character sets, and bulk count.

Length16

Strength: Excellent103 bits of entropy

How many

What is Password Generator?

Password Generator creates strong random passwords using your browser's cryptographically secure random number generator — not Math.random. Pick a length, toggle lowercase, uppercase, digits, and symbols, and generate up to 50 passwords at once. A free password generator that runs entirely in your browser, with a strength meter showing entropy in bits.

Key features

Cryptographically secure randomness via crypto.getRandomValues
Length slider with character set toggles
Guarantees at least one character from each enabled set
Option to exclude look-alike characters like l, 1, O, 0
Bulk mode: up to 50 passwords with Copy all

Password Generator — strong, random, in your browser

A password is only as unpredictable as the source of randomness behind it. This generator draws every character from your browser's cryptographically secure random number generator (crypto.getRandomValues), not Math.random — which is fast but predictable and never meant for anything security-related. It also uses rejection sampling to pick characters, so no character is even slightly more likely than another (the naive "random % poolSize" trick quietly biases toward the start of the alphabet). Nothing is generated on a server; close the tab and the passwords are gone.

Building a strong one

Three controls shape the result:

Length (4–64, default 16). Length matters more than anything else because it multiplies the difficulty exponentially. The strength meter shows entropy in bits — literally length × log₂(pool size). With all four character sets on, the pool is 86 characters, so each character adds about 6.4 bits: a 16-character password is roughly 103 bits, comfortably past the meter's 80-bit "excellent" line. A lowercase-only 8-character password, by contrast, is about 38 bits, which the meter flags red as "weak."
Character sets. Toggle lowercase (26), uppercase (26), digits (10), and symbols (24: !@#$%^&*()-_=+[]{};:,.<>?). The generator guarantees at least one character from every set you enable, then shuffles their positions, so a site that demands "one number and one symbol" is satisfied without the required characters clustering at the front.
Exclude look-alikes. Turn this on when a human will read or type the password — it removes the visually confusable characters (i l 1 L I, 0 O o, B 8, S 5, Z 2, and quote/bracket symbols) so it can't be mistyped off a screen or sticky note. Leave it off for passwords a manager stores, to keep the pool larger.

Reading the strength meter

The meter buckets entropy into four bands: weak under 40 bits, fair 40–59, strong 60–79, and excellent 80 and up. Aim for the excellent band for any account that matters — with all sets enabled, 13 characters already crosses 80 bits. If you turn sets off, you'll need more length to reach the same strength, and the meter updates live to show it.

Is this safe to use?

Yes. Generation happens 100% in your browser — no password is sent to a server, logged, or stored. You can verify it in DevTools → Network: clicking Generate fires zero requests.

Bulk generation

Set How many up to 50 to create a batch at once, then use Copy all to grab the whole list at once (or the copy button on any single row). It's handy for seeding multiple accounts, service credentials, or test environments in one go.

Frequently asked questions

Is this actually random, or predictable like Math.random?: It draws every character from your browser's cryptographically secure generator, crypto.getRandomValues, not Math.random. It also picks characters by rejection sampling, so no character is even slightly more likely than another, which makes the output safe for real accounts.
What do the 'bits of entropy' and the strength labels mean?: Entropy is length times log2 of the pool size; the higher the number, the harder the password is to crack. The meter buckets it as weak (under 40 bits), fair (40 to 59), strong (60 to 79), and excellent (80 and up); with all four sets on, a 13-character password already crosses 80 bits.
Which symbols does it use?: The symbol set is !@#$%^&*()-_=+[]{};:,.<>? which is 24 characters. Combined with lowercase, uppercase, and digits, that makes an 86-character pool, so each character contributes about 6.4 bits of entropy.
Will it satisfy a site that requires at least one number and one symbol?: Yes. The generator guarantees at least one character from every set you enable, then shuffles positions so the required characters do not cluster at the front. Just keep the digits and symbols toggles on.
What does 'exclude look-alike characters' remove?: It drops visually confusable characters such as i l 1 L I, 0 O o, B 8, S 5, Z 2, and some quote and bracket symbols, so a password cannot be mistyped when read off a screen. Turn it on for passwords a human will type, and leave it off (a larger pool) for ones a password manager stores.
Can I generate several passwords at once?: Yes, up to 50 in one go: set the count and use Copy all to grab the whole list, or the copy button on any single row. It all happens in your browser with zero network requests, which you can confirm in DevTools under the Network tab.

Privacy

Every password is generated locally using your browser's cryptographically secure random number generator, not a weaker general-purpose one; nothing is sent to a server, including the passwords themselves.