Password Generator — Custom Rules & Strength Meter
Generate secure random passwords with a chosen length and character types (uppercase/lowercase/digits/symbols), 1 to 20 at once, with an entropy (bit) score and strength label. Everything runs in your browser using crypto.getRandomValues() — nothing is ever sent anywhere.
All passwords are generated entirely inside your browser using the cryptographically secure crypto.getRandomValues() API. Nothing is sent to any server.
Generated passwords
Press "Generate" to see passwords here.
Please select at least one character type.
How to use
- Choose a length (4–64 characters), a count (1–20), and which character types to use.
- Optionally enable "Exclude ambiguous characters".
- Press "Generate" to see a list of passwords with entropy and strength, then copy them individually or all at once.
How it works
About the randomness source
All random values come from the Web Crypto API's crypto.getRandomValues(), a cryptographically secure pseudo-random number generator (CSPRNG). Math.random() is not used, since it can be predictable and is unsuitable for password generation.
When picking a character from the character set, naively taking a random value modulo the set size introduces a slight bias (modulo bias) whenever the set size doesn't evenly divide 256. This tool avoids that bias with rejection sampling: out-of-range random values are discarded and re-drawn.
How entropy (strength) is calculated
Entropy is calculated as length × log2(size of the character set in use). For example, a 16-character password using all four character types (94 possible characters) has roughly 16 × log2(94) ≈ 105 bits of entropy.
Strength is shown in four bands:
- Weak: below 40 bits
- Fair: 40–59 bits
- Strong: 60–79 bits
- Very strong: 80 bits or more
These thresholds are a commonly cited rule of thumb, not a formal industry standard. A password's real-world security also depends on factors like how fast an attacker can attempt brute-force guesses against the service it protects.
About excluding ambiguous characters
Enabling "Exclude ambiguous characters" removes six characters from the character set: 0 (zero), O (uppercase O), o (lowercase o), 1 (one), l (lowercase L), and I (uppercase I). Use this if you want to avoid characters that are easy to mistype or misread.
FAQ
Are generated passwords or my settings sent to a server?
No. Password generation happens entirely inside your browser, and no data is transmitted anywhere.
Is this really generated with secure randomness?
Yes. It uses only `crypto.getRandomValues()`, the Web Crypto API's cryptographically secure random number generator — never `Math.random()`. It also uses rejection sampling to avoid bias when selecting characters.
What is entropy, and is a higher number always better?
Entropy is a measure (in bits) of how hard a password is to guess — the higher the number, the more resistant it is to brute-force attacks. You can increase entropy by using a longer password or more character types.
What happens if I don't select any character type?
Nothing can be generated without characters to choose from. Select at least one character type (lowercase, uppercase, digits, or symbols).
Are generated passwords saved anywhere?
No. Reloading or closing the page discards the results. Copy any password you need and store it in a password manager right away.
Related tools
- Cron Expression Generator | GUI Builder & Next Run TimeBuild a cron expression from five fields or by editing it directly, validate the syntax instantly, and see the next 5 run times. Runs entirely in your browser — nothing is sent to a server.
- Hash Generator — MD5, SHA-1, SHA-256, SHA-384, SHA-512Compute MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text or a file, all at once. Useful for verifying file integrity or checksums. Everything runs in your browser — your text and files are never sent anywhere.
- JSON Formatter & Validator | Minify, Beautify, and Detect Syntax ErrorsFormat JSON with 2/4-space or tab indentation, or minify it, and see syntax errors with the exact line and column where they occur. Everything runs in your browser only — your JSON is never sent anywhere.
- Regex Tester | JavaScript Pattern Matching & Capture GroupsTest JavaScript regular expressions instantly, see highlighted matches, and inspect numbered and named capture groups. Everything runs in your browser only — your pattern and text are never sent anywhere.
- All tools