Random Password Generator
Pick a length and which character sets to draw from, then generate a random password entirely in your browser — every character comes from crypto.getRandomValues(), the Web Crypto API's cryptographically secure random source, never the weaker Math.random(). Nothing you generate here is ever sent to a server.
Generated entirely in your browser using crypto.getRandomValues (a cryptographically secure random source) — never Math.random(), never sent to a server, never logged.
Result
- Character set size
- Estimated entropy
Random Password Generator
A password's strength is usually measured in bits of entropy: how many equally likely passwords exist, generated the same way, that an attacker would have to search through before finding yours (on average, half that many guesses). Entropy depends on exactly two things — how long the password is, and how large the pool of characters each position is drawn from. This tool draws every single character independently and uniformly at random from whichever character sets you enable (lowercase, uppercase, digits, symbols) using crypto.getRandomValues(), the Web Crypto API's cryptographically secure pseudorandom source. It never uses Math.random(): that generator is fast and statistically fine for games or simulations, but it is not cryptographically secure — depending on the JavaScript engine, its internal state can in principle be reconstructed from a handful of observed outputs, which disqualifies it for anything meant to be genuinely unguessable, like a password or an API key.
Concretely, the entropy of a password of length N drawn from a character pool of size C is N × log2(C) bits. Enabling only lowercase letters gives a pool of 26 characters (≈4.7 bits per character); adding uppercase and digits brings the pool to 62 characters (≈5.95 bits per character); adding symbols on top of that pushes it further. A 16-character password from the full lowercase+uppercase+digits+symbols pool this tool offers comfortably exceeds 100 bits of entropy — far beyond what any realistic offline brute-force attack could search in a human lifetime, even against a fast, GPU-accelerated cracking rig, as long as the password is stored properly (a slow, salted hash) on the other end.
The "exclude ambiguous characters" option strips visually confusable glyphs — capital I, lowercase l, the digit 1, capital O, and the digit 0 — from whichever sets are enabled. These characters are easy to miswrite when copying a password by hand off a screen, dictating it over the phone, or typing it on a device where the font makes them hard to tell apart. Excluding them barely dents the character pool (five characters out of dozens), so the entropy loss is small; it's an ergonomics trade, not a security one, and worth enabling any time a human — not a password manager's clipboard — will be the one transcribing the result.
In practice, the real-world threat a strong, unique, randomly generated password defends against is credential stuffing: attackers take a password leaked from one breached site and try it — verbatim — against every other account you might have reused it on. A password generated fresh here for a single account can never be reused elsewhere by definition, which is the single biggest practical security win over even a very memorable, human-chosen passphrase. The trade-off is that a fully random string like this one is hard to memorize by design; pair it with a password manager rather than trying to remember it, and reserve a memorable passphrase for the handful of cases (a device unlock PIN, a password-manager master password itself) where you genuinely must type it from memory.
Glossary
- Entropy
- A measure, in bits, of how unpredictable a password is — equal to length × log2(character-pool size) for a uniformly random password like the ones this tool generates.
- Character set
- The pool of distinct characters a password can be drawn from — lowercase, uppercase, digits and symbols each add their own characters to the pool when enabled.
- crypto.getRandomValues()
- The Web Crypto API's cryptographically secure pseudorandom number generator, built into every modern browser — the only randomness source this tool uses.
- Rejection sampling
- A technique for picking a uniformly random index into the character pool without the slight bias a plain modulo operation would introduce, by discarding and re-drawing any raw random value that would skew the result.
- Credential stuffing
- An attack that replays a password leaked from one breached site against a victim's other accounts — defeated entirely by never reusing a password, which a freshly generated one by definition never has been.
- Passphrase
- A memorable alternative to a fully random password — several random dictionary words strung together — that trades some entropy per character for being realistic to type from memory.
API equivalent
This tool has no API equivalent in our service — a random password isn't an IP-address fact, so there's nothing for our API to return here. Generation above runs entirely on your device; nothing is ever sent anywhere. If you're looking for our IP-lookup API instead, it covers geolocation, ASN/network and threat/fraud data for an IP address:
Frequently asked questions
- Is Math.random() ever used to generate this password?
- No — every character comes from crypto.getRandomValues(), the Web Crypto API's cryptographically secure random source. This tool's only purpose is generating secrets, so a non-cryptographic source would be a defect, not a shortcut.
- What does "exclude ambiguous characters" do?
- It removes the visually confusable characters I, l, 1, O and 0 from whichever sets you've enabled, so the result is easier to transcribe correctly by hand or read aloud. It costs only a small amount of entropy since so few characters are removed.
- How long should my password be?
- 16 characters with all four character sets enabled comfortably exceeds 100 bits of entropy, which is a strong default for anything stored with a proper salted hash. Use a longer length for extra margin, or where a site enforces a minimum.
- Is my password sent to a server or logged anywhere?
- No — generation happens entirely in your browser's JavaScript. This page makes no network request to produce a password, and nothing is written to any log.
- Why enable symbols if letters and digits already give a large password space?
- Every character set you add increases the pool size, which increases entropy per character — symbols raise the pool from 62 to roughly 85 characters. It matters most for shorter passwords; at 16+ characters the difference is smaller but still free to take.
- Should I use this instead of my password manager's built-in generator?
- Either is fine — both use a cryptographically secure random source. This tool is useful when you need a one-off strong password without opening a password manager, or want to see the exact options and entropy math behind the result.
Like this tool? Our API gives free accounts 1,000 requests/day.See the API docs →