Skip to content
kitto works
All tools

Password Generator — Custom Rules & Strength Meter

Generate secure random passwords with a chosen length and character types (uppercase/lowercase/digits/symbols), 1 to 20 at once, with an entropy (bit) score and strength label. Everything runs in your browser using crypto.getRandomValues() — nothing is ever sent anywhere.

Character types

All passwords are generated entirely inside your browser using the cryptographically secure crypto.getRandomValues() API. Nothing is sent to any server.

Generated passwords

Press "Generate" to see passwords here.

How to use

  1. Choose a length (4–64 characters), a count (1–20), and which character types to use.
  2. Optionally enable "Exclude ambiguous characters".
  3. Press "Generate" to see a list of passwords with entropy and strength, then copy them individually or all at once.

How it works

About the randomness source

All random values come from the Web Crypto API's crypto.getRandomValues(), a cryptographically secure pseudo-random number generator (CSPRNG). Math.random() is not used, since it can be predictable and is unsuitable for password generation.

When picking a character from the character set, naively taking a random value modulo the set size introduces a slight bias (modulo bias) whenever the set size doesn't evenly divide 256. This tool avoids that bias with rejection sampling: out-of-range random values are discarded and re-drawn.

How entropy (strength) is calculated

Entropy is calculated as length × log2(size of the character set in use). For example, a 16-character password using all four character types (94 possible characters) has roughly 16 × log2(94) ≈ 105 bits of entropy.

Strength is shown in four bands:

  • Weak: below 40 bits
  • Fair: 40–59 bits
  • Strong: 60–79 bits
  • Very strong: 80 bits or more

These thresholds are a commonly cited rule of thumb, not a formal industry standard. A password's real-world security also depends on factors like how fast an attacker can attempt brute-force guesses against the service it protects.

About excluding ambiguous characters

Enabling "Exclude ambiguous characters" removes six characters from the character set: 0 (zero), O (uppercase O), o (lowercase o), 1 (one), l (lowercase L), and I (uppercase I). Use this if you want to avoid characters that are easy to mistype or misread.

FAQ

Are generated passwords or my settings sent to a server?

No. Password generation happens entirely inside your browser, and no data is transmitted anywhere.

Is this really generated with secure randomness?

Yes. It uses only `crypto.getRandomValues()`, the Web Crypto API's cryptographically secure random number generator — never `Math.random()`. It also uses rejection sampling to avoid bias when selecting characters.

What is entropy, and is a higher number always better?

Entropy is a measure (in bits) of how hard a password is to guess — the higher the number, the more resistant it is to brute-force attacks. You can increase entropy by using a longer password or more character types.

What happens if I don't select any character type?

Nothing can be generated without characters to choose from. Select at least one character type (lowercase, uppercase, digits, or symbols).

Are generated passwords saved anywhere?

No. Reloading or closing the page discards the results. Copy any password you need and store it in a password manager right away.