Password Generator
Generates random passwords with length, character set and ambiguous-character rules, in bulk if needed.
A password you invent yourself carries the shape of the language you think in, and that shape is exactly what a cracking rule set exploits. This draws characters from the browser’s cryptographic random source instead, so the only thing that determines strength is the length and the alphabet you chose.
…
Entropy
130.9 bits
Strength
Excellent
Alphabet
94 characters
Length
20 chars
How long would it take to guess?
About 10^19 years — longer than the universe has existed on average.
A stolen database hashed with unsalted MD5 or SHA-1, attacked on a rig of eight modern GPUs. This is the number to plan against, because you do not get to choose how a site stored your password. The figure is half the keyspace — 130.9 bits — divided by 1,000,000,000,000 guesses per second. It assumes the attacker knows exactly how this password was built and has no other way in; a password is rarely the weakest part of an account.
Every password here comes from crypto.getRandomValues in this tab. Nothing is sent anywhere, nothing is written to storage, and closing the tab is enough to be rid of it — there is no history to clear. The one place it does escape this page is your clipboard, which other applications can read; paste it into your password manager and copy something harmless afterwards.
How to use it
Set the length first
Length buys more than variety does. Sixteen characters from lower case alone beats eight characters from every class, and it is easier to type.
Turn classes off where the site demands it
Some systems reject symbols, or silently truncate. Excluding ambiguous characters (0/O, 1/l/I) helps when the password will be read off a screen and typed by hand.
Generate in bulk if you need to
Ask for a list when you are seeding accounts or devices. Each line is drawn independently, not derived from the one above it.
Put it somewhere before you close the tab
Nothing is stored. Once the tab is gone the password is gone with it, so paste it into a manager while it is still on screen.
Common questions
Is the password generated on a server?
No. It comes from `crypto.getRandomValues` in your browser and is never transmitted or logged. The page works with the network disconnected, which is the easiest way to check the claim yourself.
Is `Math.random` used anywhere in this?
No. `Math.random` is fast and predictable enough that its output can be reconstructed from a few samples, which makes it unusable for a secret. The selection also rejects out-of-range bytes rather than taking a modulus, so every character in the alphabet is equally likely.
Should I use this or the passphrase generator?
Use this for anything a password manager will type for you. Use the passphrase generator for the few secrets you have to remember and type by hand — a device unlock, a disk key, the manager’s own master password.
Feed it from
ULID & NanoID Generator
Generates sortable ULIDs or short NanoIDs with a chosen alphabet and length, and shows collision odds.
Password Strength Meter
Estimates how long a password would take to crack, naming the patterns that weaken it.
Passphrase Generator
Builds a diceware-style passphrase from a word list, showing the entropy in bits.
Self-Destructing Note
Encrypts a note in the browser and gives you a one-time link that destroys the note after it is read.
Next
These accept what this tool produces, so the result can go straight in.
Passphrase Generator
Builds a diceware-style passphrase from a word list, showing the entropy in bits.
Password Strength Meter
Estimates how long a password would take to crack, naming the patterns that weaken it.
Random Key Generator
Generates cryptographic random bytes as hex, Base64 or Base64URL at a chosen length, for app secrets.
Self-Destructing Note
Encrypts a note in the browser and gives you a one-time link that destroys the note after it is read.
Suspicious URL Check
Inspects a link’s shape before you open it — lookalike characters, IP-literal hosts, @ tricks, deep subdomains, odd ports, shorteners — and on request traces its redirects and looks up the domain’s registration date. No reputation database.
Audio Converter
Converts between MP3, WAV, FLAC, AAC, OGG and Opus with bitrate and sample-rate settings.