Password Generator

This tool uses the Web Crypto API (crypto.getRandomValues) to generate each character. Rejection sampling ensures every character in the set is equally likely, so there's no bias toward any part of the alphabet. Script blockers may prevent the tool from working.

The strength meter shows the password's entropy in bits (length × log₂ of the character set size). Anything above 80 bits is out of reach of brute-force attacks; 128 bits or more is excellent.

The contents of this page are delivered over a secure (HTTPS) connection. You should verify this, and the site's certificate, before using the tools on this site.

The terms 'random' and 'pseudorandom' are used interchangeably here. Computers can't easily produce truly random numbers, but a cryptographically secure pseudorandom generator is more than sufficient for passwords.

If your browser doesn't support crypto.getRandomValues, the tool refuses to generate a password rather than falling back to the insecure Math.random.

The JavaScript used to generate passwords is available for inspection via your browser's developer tools, or directly at js/randomizer.js.