// generator
Not all “random” is equal — many online generators use a weak pseudo-random function. This one uses the Web Crypto API's CSPRNG, the same class of randomness source used in real cryptographic software.
Create several passwords at once using the settings above — useful for provisioning multiple accounts.
Type any password to score it instantly. This runs entirely in your browser — nothing is sent anywhere, logged, or stored.
This generator uses crypto.getRandomValues with rejection sampling to eliminate bias — every character in your selected set has an equal chance of appearing.
Toggle uppercase, lowercase, numbers, and symbols to match what a specific site or system requires.
There's no limit and nothing is logged — generate as many candidates as you want until one feels right.
Predictable patterns — even subtle ones from a weak random function — can theoretically be exploited. A CSPRNG removes that risk entirely.
Math.random() is fast but not cryptographically secure and can be predictable. crypto.getRandomValues() is designed specifically for security-sensitive use, which is what this generator uses exclusively.
Yes — toggle 'exclude ambiguous characters' to remove easily-confused characters like 1, l, I, O, and 0, or add your own custom exclusions.
The Web Crypto API's crypto.getRandomValues() is a documented web standard implemented by the browser itself, not by this site — you can inspect the same standard behavior in any modern browser's developer tools.
No — for a truly random generator, longer is strictly never weaker. The only “downside” of extra length is practicality if you have to type it manually often.
Most modern browser autofill generators also use secure random sources, so they're comparably safe — this tool simply gives you more direct control over length, character sets, and exclusions.