Password Generator

Create cryptographically secure passwords using your browser's built-in crypto.getRandomValues() API. Configure length, character sets (uppercase, lowercase, digits, symbols), and exclude ambiguous characters like 0/O and 1/l/I that are easy to confuse when reading or typing.

**How secure password generation works**

The generator uses the Web Crypto API (window.crypto.getRandomValues()), which draws from your operating system's cryptographically secure random number generator. This is the same entropy source used by TLS/SSL connections and is far more random than Math.random(), which is a pseudo-random number generator designed for speed, not security. Each character in your password is selected independently from your chosen character set, ensuring a uniform distribution.

**Understanding password strength**

Password strength depends on two factors: length and character diversity. A 12-character password using all four character sets (uppercase, lowercase, digits, symbols — 95 possible characters) has roughly 78 bits of entropy, which would take a modern GPU cluster millions of years to brute-force. A 16-character password from the same set has 104 bits of entropy, which is effectively unbreakable with current technology. The built-in strength meter shows you an estimated crack time so you can make informed decisions.

**Bulk generation and excluded characters**

Generate up to 100 passwords at once for team setups, temporary access codes, or database seeding. The ambiguous character filter removes characters that look similar in common fonts: 0 (zero) vs O (capital O), 1 (one) vs l (lowercase L) vs I (capital I). This is especially useful when passwords need to be read aloud, typed from a printout, or communicated over the phone.

**Common use cases**

IT administrators generate strong passwords for new employee accounts and service accounts. Developers create secrets for API keys, database credentials, and JWT signing keys. Individuals generate unique passwords for each online account to limit the damage if any single service is breached. Security teams use bulk generation for temporary access codes that expire after a single use.

**Privacy**

Your passwords are generated entirely client-side and never sent to any server. The Web Crypto API operates within the browser's security sandbox and does not make network requests. No passwords are logged, cached, or stored. Each time you generate, the previous set is discarded.