Password Generator
Generate strong random passwords using the browser's cryptographically secure Web Crypto API, never Math.random. Set the length, toggle lowercase, uppercase, digits and symbols, optionally exclude visually ambiguous characters, and see a live entropy-based strength estimate. Bulk-generate dozens of passwords at once and copy them all with one click.
Reviewed by Vincenzo Manto, Founder & Lead Developer · Last updated September 27, 2026
How it works
- 1
Set the password length and toggle which character types to include.
- 2
Optionally exclude ambiguous characters like 0/O or 1/l/I.
- 3
Click generate to get a password produced with the Web Crypto API, plus a strength rating.
- 4
Switch to bulk mode to generate a list of many passwords at once and copy them all.
Why randomness quality matters
A password generator is only as strong as its source of randomness. This tool uses the Web Crypto API's getRandomValues, the same primitive used for cryptographic keys, rather than Math.random, which uses a predictable, non-cryptographic algorithm unsuitable for anything security-related.
Understanding entropy and strength
Entropy measures how unpredictable a password is, in bits. Every extra bit doubles the number of guesses an attacker would need. This tool shows the exact bit count alongside a plain-language label, so you don't need a security background to judge whether a password is strong enough for your use case.
Frequently asked questions
How is randomness generated?
Using the browser's built-in Web Crypto API (crypto.getRandomValues), which is designed for security-sensitive randomness. Math.random is not cryptographically secure and should never be used for passwords.
What does the strength meter measure?
It calculates entropy in bits as length × log2(character-set size), a standard way to estimate how many attempts a brute-force attacker would need, then bands the result into very weak, weak, fair, strong, or very strong.
Why would I exclude ambiguous characters?
Characters like 0/O, 1/l/I, or | can be hard to tell apart in some fonts, which causes typing mistakes when a password must be entered manually (e.g. read off a printed sheet). Excluding them trades a small amount of entropy for fewer transcription errors.
Is my generated password sent anywhere?
No. Password generation happens in your browser using local JavaScript, so nothing is transmitted or logged.
Can I generate many passwords at once for a team or a list of accounts?
Yes, use the bulk-generate mode to create up to 500 passwords in one go and copy them all as a list.