Generators tool

Strong passwords, generated locally.

Built from your operating system's cryptographic random source, in this tab. Nothing is sent anywhere, and nothing is remembered once you close the page.

  • Free, no sign-up
  • Nothing is uploaded
  • No watermark, no limits

Password generator

Free
Length 20

Avoiding lookalikes drops l, I, O, 0 and 1 — worth it for anything you might read aloud or type from a screen.

Runs entirely in your browser. Nothing is uploaded. Generated with crypto.getRandomValues

Worth knowing

How to get this right.

  1. 01

    Length beats complexity, every time

    Adding one character to a password multiplies the search space by the size of the alphabet. Adding a symbol to a short one barely moves it. A 20-character password from lowercase letters alone is far stronger than an 8-character one with every trick applied — and much easier to type.

  2. 02

    Entropy is the honest measure

    The bar above reports bits of entropy rather than a vague word. Under 50 bits is guessable by anyone motivated. Around 75 is fine for ordinary accounts. Past 100 bits you are protected against anything that exists, and the remaining risk is entirely about where you store it.

  3. 03

    Use a manager, and reuse nothing

    A generated password you cannot remember is the point — it means you are storing it rather than reusing one you can recall. The single biggest real-world risk is not a weak password, it is the same decent password across forty sites, one of which gets breached.

Questions

About this tool.

No. It is generated in your browser with crypto.getRandomValues, the operating system's cryptographic random source, and never leaves the page. Close the tab and it is gone.
No, and this tool does not use it. Math.random is a fast pseudo-random generator whose output can be predicted from previous values. Anything security-related has to use the crypto API, which this does.
Twenty characters is a good default for accounts that matter. For a master password on a manager, go longer — you only type it once a day and it protects everything else.
Because at some point you will read a password off a screen or dictate it over a call, and capital I, lowercase l and the digit 1 are indistinguishable in most fonts. Dropping five characters costs a fraction of a bit of entropy and saves real frustration.

Need this built into something?

These are the small pieces. We build the systems they belong to.

Free scope, fixed price.We reply within one business day.

Get started