Password generator
Cryptographically secure passwords in your browser via Web Crypto API. Configurable length, character sets, bulk generation.
Characters per password, 4 to 64. Adjustable in steps of one with the arrow keys.
How many passwords are generated at once, 1 to 100.
Character types in the password: A–Z upper case, a–z lower case, 0–9 digits, !@#$% symbols. "Unambiguous" leaves out easily confused characters such as 0 and O or 1, l and I. Generated only in your browser.
How this tool works
Generates cryptographically secure passwords directly in your browser via the Web Crypto API (`crypto.getRandomValues()`) — no server call, no log, no cookie. Configurable: length (4–256 chars), count (1–100 in one batch), character classes (uppercase, lowercase, digits, symbols), plus an optional "unambiguous" mode that excludes visually similar chars like 0/O, 1/l/I, S/5, B/8, Z/2. Per-password entropy is shown in bits — 80 bits is considered strong today, 128 bits very strong.
Typical use cases
- Master password for a password manager — 24+ chars with all classes → 158 bits entropy, brute-force safe
- Bulk generation for test accounts in staging/dev environments — 50 passwords in one click as CSV-friendly list
- Service account credentials that humans never type — long random strings without readability compromise
- Onboarding passwords for customers with "unambiguous" mode — avoids support tickets from 0/O confusion
- Generate API keys or tokens when the backend generator is unavailable
- Rotation passwords for periodic credential changes — 60-day cycle with 20-char strings
Frequently asked questions
Are the passwords really secure?
Yes. They come from `crypto.getRandomValues()` — the browser CSPRNG, the same one TLS keys and crypto wallets use. Math.random() (often mistakenly used) would not be secure.
Are passwords stored or logged anywhere?
No. Generation runs entirely in your browser tab. When you close the tab they are gone. No server request, no analytics, no localStorage.
What is entropy and how much do I need?
Entropy measures randomness. Each bit doubles the combinations. 60 bits = online-safe (brute force against login attempts), 80 bits = medium-term offline-safe, 128 bits = quantum-resistant. For master passwords aim for at least 100 bits.
What is the "unambiguous" mode for?
When typing passwords (at a console, on the phone to IT, during onboarding) chars like 0/O, 1/l/I, S/5, B/8, Z/2 are easy to mix up. The mode filters them — costs a few bits of entropy, saves many support calls.
Should I use symbols too?
If the target system allows: yes. 26 extra chars dramatically increase the search space. With legacy login systems that bug on symbols, omit them and compensate with length.
How is this different from 1Password/Bitwarden generators?
Functionally nothing — all use CSPRNG. The difference: this tool is account-free, install-free, login-free, immediately usable. Plus it shows entropy transparently. For daily use, master passwords should still live in a password manager.
Related tools
Continuous monitoring vs. one-shot?
XICTRAQ monitors uptime, SSL, security headers, GDPR and performance 24/7. Free plan, no credit card.