Z

Password Generator

Generate strong, random passwords with custom length and character sets — in your browser.

Runs in your browser — files never leave your device

Generated with secure randomness, entirely on your device.

How it works

Set a length between 6 and 64 characters (the slider defaults to 16), tick the character sets you want, and click Generate. The password appears with a copy button; clicking Generate again draws a completely fresh one.

Randomness comes from crypto.getRandomValues, the browser’s cryptographically secure random number generator — the API designed for key material, not the predictable Math.random. Each position in the password is drawn independently and uniformly from the combined pool of enabled sets: 26 lowercase letters, 26 uppercase letters, 10 digits, and 23 symbols — 85 characters at full strength.

Strength is measured in bits of entropy: length × log2(pool size). With all four sets enabled, each character contributes about 6.4 bits:

  • 12 characters ≈ 76.9 bits — a reasonable floor for low-value accounts
  • 16 characters ≈ 102.6 bits — the default, comfortably beyond brute-force reach
  • 20 characters ≈ 128.2 bits — for master passwords and long-lived secrets

Dropping the symbol set shrinks the pool to 62, so a 16-character password falls to about 95.3 bits — still strong, and easily recovered by adding a few characters of length. As a concrete example, with everything enabled at length 16 you might get x7!Kp@2mQ#9vR}4c — yours will differ on every click, which is the point.

Two practical notes. Characters are drawn independently, so nothing forces every enabled set to appear — a password can lack a digit even with digits ticked; regenerate if a site demands one. And because some sites reject specific punctuation, the symbol set sticks to common characters (!@#$%^&*()-_=+[]{};:,.?) — if a site still complains, untick symbols and add length instead. Store the result in a password manager, and never reuse it across sites.

Frequently asked questions

How is the password generated?
Each character is drawn independently with crypto.getRandomValues — the browser’s cryptographically secure random number generator, the same API used for key generation in web cryptography. Math.random is never used; its output is predictable and unsafe for secrets.
How long should my password be?
Sixteen characters with all four sets enabled (about 102.6 bits of entropy) is a strong default that puts offline cracking out of reach. Treat 12 characters (76.9 bits) as a floor for low-value accounts, and go to 20 or more (128.2 bits and up) for password-manager master passwords, disk encryption, or anything long-lived.
What do the entropy numbers actually mean?
Entropy measures how many equally likely passwords your settings could produce: bits = length × log2(pool size), and each extra bit doubles an attacker’s worst-case work. With all sets enabled the pool is 85 characters, so every character you add contributes about 6.4 bits — adding length strengthens a password faster than swapping in exotic characters.
Why does my password sometimes lack a digit or symbol I enabled?
Characters are drawn independently, so nothing guarantees that every enabled set appears — a 16-character password will occasionally contain no digit even with digits ticked. If a site insists on at least one digit or symbol, click Generate again; a missing set does not weaken the password itself.
Which symbols are included?
The symbol set is !@#$%^&*()-_=+[]{};:,.? — 23 punctuation characters chosen to be widely accepted. If a site rejects symbols entirely, untick the set and add length to compensate: a 20-character letters-and-digits password (119.1 bits) is stronger than a 16-character one drawn from all four sets (102.6 bits).
Should I use a password manager with this?
Yes — the practical way to use random passwords is to generate a unique one per site and let a password manager remember it. Reusing even a very strong password erases its benefit the first time any single site leaks it.
Are passwords sent anywhere?
No. Passwords are generated on your device with the browser’s secure random generator and are never stored, logged, or transmitted; regenerating or closing the tab discards them. Copy the result straight into your password manager.

Related tools