TOOL · DEV
Strong password generator
Passwords drawn with your browser’s own cryptography (crypto.getRandomValues), with an honest strength meter in bits — we don’t see, store or send anything.
The password is generated in your browser with the system’s cryptographic randomness (crypto.getRandomValues). We don’t store, send or see anything — close the tab and it’s gone.
Processed in your browser — your files never leave your computer.
How it works
-
Set length and types
Slider from 8 to 64 characters (20 is the default) and checkboxes for uppercase, lowercase, numbers and symbols — keep at least one type checked.
-
Click "Generate password"
Want options? "Generate 5 at once" lists five passwords to choose from. The draw uses crypto.getRandomValues, with no bias.
-
Check the strength and copy
The meter shows entropy in bits and the level (weak to very strong). One click copies — and once the tab closes, the password is gone from here.
Frequently asked questions
Do you store or see the generated passwords?
No — and that is the whole point of the tool. The password is drawn inside your browser and never leaves it: no server, no logs, no analytics watching. Close the tab and it only exists where you pasted it.
How is the password generated?
With crypto.getRandomValues, the browser’s own cryptographic generator — the same one used for encryption keys. The draw uses rejection sampling to avoid modulo bias: every character in the chosen alphabet has exactly the same chance.
What does "bits of entropy" mean?
It is the mathematical measure of how many combinations an attacker would need to try. Each bit doubles the work: 60 bits are a million times harder than 40. Above ~80 bits is already strong for everyday accounts; above 110, very strong.
What length should I use?
The default of 20 characters with all 4 types checked goes past 120 bits — more than enough. If a site limits the length, keep the maximum it accepts; if it rejects symbols, uncheck them and compensate with more length.
Can I trust an online password generator?
Suspicion is healthy in general — the risk is a site sending the password to its server. Here the draw is 100% local and verifiable: the code runs in your browser, and you can even turn off Wi-Fi before generating and it works the same.
Where do I keep the passwords I generate?
In a password manager (the browser’s built-in one works, a dedicated one is better) — never in a text file, never reused across sites. This tool generates; storing is the manager’s job.