Password Generator

Generated in your browser, not on a server

Everything happens client-side — the password is built in your browser's JavaScript and never transmitted anywhere, so there's nothing to intercept in transit and nothing logged on a server.

Choose the length and which character sets to include (uppercase, numbers, symbols), and it builds a random password from that pool. Longer and more varied is generally stronger against brute-force guessing.

Why length matters more than complexity

Each extra character multiplies the number of possible combinations, so a longer password with a smaller character set is often stronger than a short one crammed with symbols — a 16-character password is dramatically harder to brute-force than a 8-character one, even before adding uppercase or symbols. The real-world weak point for most people isn't password strength anyway, it's reuse: the same password across multiple sites means one breached site compromises every account using it. A password manager that generates and stores a unique password per site closes that gap in a way no single strong password can.

Cryptographically random, not just "random"

This generator specifically uses the Web Crypto API (crypto.getRandomValues) rather than JavaScript's ordinary Math.random, which matters here in a way it wouldn't for something like a dice roll. Math.random is a fast, non-cryptographic pseudo-random generator whose internal state can, in theory, be inferred from enough of its output — a real weakness for something used to generate secrets, even if the practical risk for a casual password is low. A password generator that skips this distinction isn't necessarily broken, but it's cutting a corner it shouldn't for a tool whose entire job is producing something unpredictable.

What this tool can't protect you from

A strong, unique password doesn't help if it's reused after being typed into a phishing site, stored in an unencrypted note, or if the account itself is compromised through a data breach on the service's end rather than a weak password. Pairing a generator like this with a password manager and two-factor authentication where it's offered covers the gaps a strong password alone can't.