Password Generator - Random, Local, Never Transmitted
Generate a random password using your browser's cryptographic random number generator, not a predictable one. Nothing you generate is sent anywhere or logged - close the tab and it's gone.
Maintained by Hirantha Sandaruwan Lakshan. Updated 31 July 2026.
How it works
The password is built using the Web Crypto API's getRandomValues(), a cryptographically secure random number generator provided by the browser itself, not a general-purpose Math.random() that isn't designed for security use.
Each character is picked independently from the character sets you enable - uppercase, lowercase, numbers, and symbols - so the result doesn't lean predictably toward any one set.
Nothing about the generated password is stored, sent over the network, or written to any log. Refreshing the page or closing the tab leaves no trace.
Worked examples
A new account password
Set a length of 16 or more with all character sets enabled for a password that resists both guessing and brute force.
A password for a system with restrictions
Some older systems reject symbols or require a specific length - turn off the sets you don't need and adjust the slider to match.
Generating several at once
Click regenerate as many times as you like - each one is independently random.
Length and strength, all four character sets enabled
| Length | Possible combinations | Approximate strength | Verdict |
|---|---|---|---|
| 8 | 88^8 | About 52 bits | Too short - crackable by a determined attacker with modern hardware |
| 12 | 88^12 | About 78 bits | Reasonable minimum for a low-value account |
| 16 | 88^16 | About 103 bits | The default here - comfortably beyond brute force |
| 20 | 88^20 | About 129 bits | For password managers, where length costs you nothing |
Frequently asked questions
Is this actually secure, or just random-looking?
It uses the Web Crypto API's getRandomValues(), the same cryptographically secure source browsers use for things like generating encryption keys - not a predictable pseudo-random function.
Is my generated password sent anywhere?
No. It's generated and displayed entirely in your browser tab and never transmitted.
How long should my password be?
16 characters or more with all character sets enabled is a reasonable baseline for most accounts today.
Why exclude similar-looking characters?
An optional setting removes characters like 1, l, and I, or 0 and O, that are easy to mistype when reading a password off a screen or writing it down.
Should I reuse a generated password across sites?
No - use a different one per account, ideally kept in a password manager, so a breach on one site can't be used to access others.
Are these passwords truly random?
They come from the browser's cryptographic random number generator, the same source used for encryption keys - not from Math.random, which is predictable and unsuitable.
Should I write the password down?
A password manager is better. If you do write one down, physical paper kept somewhere safe is a reasonable fallback, and far better than reusing a memorable password everywhere.
Do passphrases beat random passwords?
A long passphrase of unrelated words is easier to type and remember at similar strength. A random string is stronger per character, which is why it wins when a manager does the remembering.
Sources & references
Updated Jul 31, 2026