Password Generator
Generate secure random passwords with customizable options.
Generated Password
Options
Character Types
A strong, unique password is still the first line of defense for most online accounts, and inventing one by hand usually means falling back on predictable patterns. This free password generator creates cryptographically secure random passwords in your browser — nothing you generate ever leaves your device. Set the length, choose the character classes, and produce as many independent passwords as you need.
How to Use
- Set the length. The slider covers 8 to 128 characters; 16 is a strong default, and 32+ suits API keys and master passwords.
- Choose the character classes. Lowercase, uppercase, digits, and symbols can each be toggled. Including all four maximizes the per-character entropy.
- Optionally exclude similar characters. Turn this on when a person will type the value by hand; it removes look-alikes such as
l,1,I,O, and0. - Generate and review. The strength indicator rates the result as you tweak the settings, so you can see the effect of each change.
- Copy it immediately into your password manager. The page does not store the value, and reloading clears it.
Worked Examples
Example 1 — an email account. A 16-character password with all four classes is the recommended baseline. It is unguessable by brute force at any realistic rate, and since a manager will paste it, it never needs to be memorized or typed.
Example 2 — a Wi-Fi password to share. Guests will type it from a card, so length 20 with symbols disabled and “exclude similar” on avoids the l/I/1 and O/0 confusion that turns a shared password into a support call. Twenty alphanumeric characters still carry ample entropy.
Example 3 — an API signing key. A 48-character string with all classes enabled gives roughly 300 bits of entropy — far beyond any practical attack — suitable for a webhook secret or a service token. Copy it straight into your secrets manager and never into a commit.
What Makes a Password Strong
Strength is a question of entropy: how many candidates an attacker would have to try. Entropy grows with password length and with the size of the character pool, but length dominates. Adding one character multiplies the search space by the pool size, while adding a character class only increases the per-character contribution modestly. A 16-character random password from roughly 90 symbols has about 104 bits of entropy; an 8-character password has around 52, which a modern GPU can exhaust.
Two habits quietly destroy otherwise strong passwords. The first is reuse — one breach then exposes every account that shares the value. The second is predictable mutation, such as swapping a for @ or appending a year to a dictionary word; cracking tools try those transformations first because everyone reaches for them. Random generation sidesteps both: each password is unique and contains no pattern to exploit.
How the Randomness Is Generated
The generator uses crypto.getRandomValues(), the browser’s cryptographically secure random number generator. Unlike Math.random(), which is designed for statistical distribution and can be predicted if its internal state is known, this API draws from an operating-system entropy source and is suitable for secrets. Each character is selected uniformly from the enabled pool, so there is no bias toward particular letters or positions.
Equally important is what the tool does not do: it keeps no history, writes no logs, and sends nothing over the network. The value exists only in your browser tab until you copy it.
Common Mistakes and Edge Cases
- Reusing a password across sites. The most damaging mistake. Use a manager so each account gets its own value.
- Choosing complexity over length.
P@ssw0rd!satisfies composition rules but appears near the top of every cracking wordlist. A longer random string beats a short clever one. - Storing the password next to the account. A sticky note under the keyboard or a plaintext file on the desktop undoes the generator entirely.
- Typing instead of pasting. Manual transcription introduces errors and encourages shorter, typeable passwords. Paste from the manager whenever you can.
- Ignoring account recovery. Enable two-factor authentication and keep recovery codes; a perfect password cannot save an account whose reset email is compromised.
- Setting the length to the bare minimum. Eight characters exists for compatibility, not for security. Treat it as the lowest setting you would ever accept.
Features
- Cryptographically secure generation via the Web Crypto API
- Adjustable length from 8 to 128 characters
- Toggle lowercase, uppercase, digits, and symbols independently
- Option to exclude visually similar characters
- Live strength indicator as you change the settings
- 100% client-side: no server, no logging, no storage
Use Cases
- Account security: Strong, unique passwords for email, banking, and social accounts.
- Password managers: Generate a long master password and fill new entries instantly.
- API keys and secrets: Mint unbiased random tokens for services and webhooks.
- Temporary access: One-off passwords for demo, shared, or guest accounts.
Related Tools
Frequently Asked Questions
How long should the password be?
Sixteen characters is a strong default for important accounts, and twelve is a reasonable floor for anything you care about. Length matters more than symbol variety: a 16-character random password from a 90-character pool has far more entropy than an 8-character one with every character type. Every extra character multiplies an attacker's search space, so adding length is almost always the best upgrade.
Should I exclude similar characters?
Enable it when a human will read or type the password — a Wi-Fi password written on a card, a shared account dictated over the phone. It removes look-alikes such as l, 1, I, O, and 0 that cause transcription errors. When a password manager copies the value directly, leave it off for slightly more entropy.
What does 'cryptographically secure' actually mean here?
The generator draws randomness from the browser's Web Crypto API (crypto.getRandomValues), the same source used for TLS keys. It is not a predictable pseudo-random function like Math.random, so an attacker cannot reproduce the sequence from a known seed. The password is still only as safe as where you store it.
Are the generated passwords sent anywhere?
No. Generation happens entirely in your browser with JavaScript; nothing is transmitted, logged, or cached on a server. The password exists only in the page until you copy it, and reloading clears it. That makes the tool safe for real accounts, not just throwaway ones.
Is one long password enough, or do I need one per site?
One per site. Reuse is the single biggest password risk: when any one service is breached, attackers replay the leaked email and password pair against every other site (credential stuffing). Random generation makes each value independent, so a breach stays contained to that one account.
Can I use a generated password as an API key or secret?
Yes — a random string of 32 or more characters works well as a client secret, signing key, or test token. For anything long-lived, store it in a secrets manager rather than in source control, and rotate it if it may have been exposed. The generator's output is unbiased random data, which is exactly what key material should be.
Reviewed by the HandyTools Hub team · Last updated