Strong Password Generator
Generate cryptographically secure random passwords. Customize, bulk-generate, and export.
Passwords are generated using crypto.getRandomValues(), which is cryptographically secure. Nothing is stored or transmitted.
About This Tool
This password generator uses crypto.getRandomValues(), the browser's cryptographically secure random number generator, to produce passwords that are statistically unpredictable. You can customize the length (4 to 128 characters), choose character sets (uppercase, lowercase, digits, symbols), exclude visually ambiguous characters like 0, O, l, and 1, and generate up to 100 passwords at once. Passwords are never sent to a server, logged, or stored in any way.
How to Use
- Set the Length slider. Sixteen characters minimum is recommended, and 32 or more for high-value accounts.
- Check the character sets you want: uppercase, lowercase, digits, symbols. More variety = more entropy.
- Optionally enable Exclude ambiguous to avoid look-alike characters in printed passwords.
- Set the Quantity if you need multiple passwords at once.
- Click Generate, then copy individual passwords or export all to TXT/CSV.
Frequently Asked Questions
How long should a secure password be?
At least 16 characters for regular accounts; 24+ for financial and email accounts. A 16-character random password using all character types has ~100 bits of entropy, enough to resist brute-force attacks for billions of years with current hardware.
Is crypto.getRandomValues() really secure?
Yes. crypto.getRandomValues() is seeded from the operating system's entropy pool (equivalent to /dev/urandom on Linux). It is the same source used by TLS and SSH key generation, and is suitable for cryptographic purposes.
Should I use a password manager with these passwords?
Yes, strong passwords are only practical when stored in a password manager like Bitwarden, 1Password, or KeePass. Generate a unique password for every account and store them all in your manager. Never reuse passwords across sites.
What is the difference between a passphrase and a random password?
A passphrase strings together several random dictionary words, which is easier for a human to type or memorize while still reaching high entropy if enough words are used. A random character password draws from letters, digits, and symbols and packs more entropy per character, but is harder to type manually. For anything stored in a password manager and never typed by hand, a random character password is the more compact, higher-entropy choice.
Why did my exported CSV file show quotes around passwords with commas?
CSV is a comma-separated format, so any password containing a comma or symbol would otherwise be misread as two separate fields. The export wraps each password in quotes and escapes any internal quote characters so spreadsheet software and password managers import the exact password unchanged.
Common Use Cases
- Onboarding a batch of new accounts. Set the quantity slider to match your team size, generate a full batch, and export to CSV for bulk import into your password manager or provisioning script.
- Replacing a password after a data breach notice. If a service you use reports an incident, generate a fresh, unique password immediately rather than reusing a variant of your old one.
- Setting a temporary secret for a development environment. Generate a throwaway high-entropy string for a local API key, database password, or test config value that never needs to be memorized.
- Printing guest Wi-Fi credentials. Enable "Exclude ambiguous" so guests reading a printed card don't confuse a lowercase L with a 1, or a zero with the letter O.
- Meeting a site's specific password rules. Use the custom character set field to match a site that only allows certain symbols, or disable symbols entirely for legacy systems that reject them.
Passphrase vs Random Password: The Entropy Math
A random password drawn from a 94-character set (uppercase, lowercase, digits, symbols) gets about 6.55 bits of entropy per character, so a 16-character random password reaches roughly 105 bits. A passphrase built from a 7,776-word list (the size of the common Diceware wordlist) gets about 12.9 bits per word, so a 6-word passphrase also reaches roughly 77 bits, and 8 words reaches about 103 bits, comparable to the 16-character random password. The practical tradeoff is typing and memorization: a passphrase is easier to type accurately on a phone keyboard or read aloud, while a random password packs more entropy into fewer keystrokes. If a password is only ever copy-pasted from a manager, favor the random password for its density. If it must occasionally be typed by hand, a longer passphrase is more forgiving.
Troubleshooting
- A site rejects the generated password. Some sites cap length (commonly at 20 or 32 characters) or block specific symbols. Lower the length slider or use the custom character set field to remove the symbols that site's validation rejects.
- "No repeating characters" produced a shorter password than I asked for. This option removes each character from the pool once it's used, so the maximum possible length is capped at the size of your selected character set. Widen the character set (enable more of uppercase, lowercase, digits, symbols) to allow longer no-repeat passwords.
- The Copy button doesn't do anything. The Clipboard API used for one-click copying requires a secure context (HTTPS or localhost). If you're viewing the page over plain HTTP for some reason, some browsers silently block the clipboard write, select the text manually instead.
- I need only digits or only letters for a specific field. Uncheck the character sets you don't need, or type the exact allowed characters into the custom character set field to override the checkboxes entirely.
Want to test how strong your password is? Check password strength →