# Password Generator - Random, Local, Never Transmitted

Page: https://hirantha.me/tools/password-generator
Part of: Hirantha Sandaruwan Lakshan free tools (https://hirantha.me/tools)
Updated: 2026-07-31

Generate a strong, random password with a length and character set you choose.

This is a free tool that runs in the browser: open the page to use it. File tools process files on the visitor's own device; files are never uploaded or stored. No account, sign-up, payment or watermark.

Generate a random password using your browser's cryptographic random number generator, not a predictable one. Nothing you generate is sent anywhere or logged - close the tab and it's gone.

The password is built using the Web Crypto API's getRandomValues(), a cryptographically secure random number generator provided by the browser itself, not a general-purpose Math.random() that isn't designed for security use.

Each character is picked independently from the character sets you enable - uppercase, lowercase, numbers, and symbols - so the result doesn't lean predictably toward any one set.

Nothing about the generated password is stored, sent over the network, or written to any log. Refreshing the page or closing the tab leaves no trace.

Length and strength, all four character sets enabled:
| Length | Possible combinations | Approximate strength | Verdict |
| --- | --- | --- | --- |
| 8 | 88^8 | About 52 bits | Too short - crackable by a determined attacker with modern hardware |
| 12 | 88^12 | About 78 bits | Reasonable minimum for a low-value account |
| 16 | 88^16 | About 103 bits | The default here - comfortably beyond brute force |
| 20 | 88^20 | About 129 bits | For password managers, where length costs you nothing |

Q: Is this actually secure, or just random-looking?
A: It uses the Web Crypto API's getRandomValues(), the same cryptographically secure source browsers use for things like generating encryption keys - not a predictable pseudo-random function.

Q: Is my generated password sent anywhere?
A: No. It's generated and displayed entirely in your browser tab and never transmitted.

Q: How long should my password be?
A: 16 characters or more with all character sets enabled is a reasonable baseline for most accounts today.

Q: Why exclude similar-looking characters?
A: An optional setting removes characters like 1, l, and I, or 0 and O, that are easy to mistype when reading a password off a screen or writing it down.

Q: Should I reuse a generated password across sites?
A: No - use a different one per account, ideally kept in a password manager, so a breach on one site can't be used to access others.

Q: Are these passwords truly random?
A: They come from the browser's cryptographic random number generator, the same source used for encryption keys - not from Math.random, which is predictable and unsuitable.

Q: Should I write the password down?
A: A password manager is better. If you do write one down, physical paper kept somewhere safe is a reasonable fallback, and far better than reusing a memorable password everywhere.

Q: Do passphrases beat random passwords?
A: A long passphrase of unrelated words is easier to type and remember at similar strength. A random string is stronger per character, which is why it wins when a manager does the remembering.

Sources: Web Crypto API - MDN (https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API); Crypto.getRandomValues() - MDN (https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues)

Related tools:

- [QR code generator](https://hirantha.me/tools/qr.md): Turn a link, note, or Wi-Fi password into a QR code you can download.
- [Password strength checker](https://hirantha.me/tools/password-strength-checker.md): Test a password in your browser: guess estimate, patterns found, crack times at stated speeds and a random passphrase maker. Nothing is sent anywhere.
- [Random number generator](https://hirantha.me/tools/random-number-generator.md): Pick random whole numbers or decimals in any range, with or without repeats, drawn fairly from your browser's secure random number generator.
- [UUID generator](https://hirantha.me/tools/uuid-generator.md): Generate random version 4 UUIDs, one at a time or in bulk.
- [Hash generator](https://hirantha.me/tools/hash-generator.md): Generate a SHA-1, SHA-256, SHA-384, or SHA-512 hash of text.