Password Generator

How it works

Each character is picked uniformly at random from the enabled character pool using crypto.getRandomValues — the same cryptographic source used by browsers for TLS keys. The password is computed entirely in your browser and never sent over the network.

Frequently asked

How long should my password be?

For most accounts, 16+ characters with mixed types. For high-value accounts (email, banking) and sensitive data, use 20+ characters. Length matters more than complexity once you are above 16.

Should I exclude similar-looking characters?

Yes if you ever need to type the password by hand or read it aloud. Excluding 0/O, 1/l/I, etc. avoids transcription errors. For passwords saved in a manager, leave them in.

Is the random source secure?

Yes. We use crypto.getRandomValues, the same cryptographically-secure RNG that browsers use for HTTPS keys. Math.random would not be safe — we don't use it here.