Password Generator

What is a password generator?

A password generator produces a string of characters chosen at random from a chosen character set (uppercase letters, lowercase letters, digits, and symbols). Unlike a password you make up yourself, a machine-generated password has no memorable pattern, which makes it far more resistant to dictionary attacks, credential-stuffing, and guessing. This tool uses crypto.getRandomValues(), the cryptographically secure random number generator built into every modern browser, so the output is suitable for real account passwords — not just Math.random(), which is predictable and unsuitable for security purposes.

How it works

Move the length slider and toggle character classes; each change re-runs the generator instantly. Internally we fill a typed array with cryptographically secure random bytes, then map each byte to an index within your selected character set (excluding ambiguous characters like 0/O and 1/l/I to improve readability). The password never touches a network request — everything happens client-side in this tab.

Worked example

Suppose you need a 20-character password with all four character classes enabled. With ~90 possible characters per position, the theoretical keyspace is roughly 90²⁰ ≈ 10³⁹ combinations — far beyond what any current hardware could brute-force. Compare that to a remembered password like Summer2024!, which an attacker could crack in seconds using a dictionary-based rule list.

Common mistakes

• Reusing the same password across multiple sites — a single breach compromises every account.
• Choosing short passwords (under 12 characters) even when a site allows longer ones.
• Disabling symbols/digits "for convenience," shrinking the character set and thus the entropy.
• Storing generated passwords in plain text files instead of a password manager.

Security notes

All generation happens client-side; the page makes no network requests when producing a password. Still, always paste generated passwords directly into a reputable password manager rather than emailing or messaging them, and enable two-factor authentication wherever it's offered as a second layer of defense.

Code examples

const chars = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789!@#$%^&*";
const bytes = new Uint8Array(20);
crypto.getRandomValues(bytes);
const password = Array.from(bytes, b => chars[b % chars.length]).join("");

import secrets, string

alphabet = string.ascii_letters + string.digits + "!@#$%^&*()"
password = "".join(secrets.choice(alphabet) for _ in range(20))

Password Generator FAQ

Related tools