Random Password Generator

What is the Random Password Generator?

A password generator that runs entirely on your device. Choose a length and character sets for a classic password, or a number of words for a passphrase that is easier to type and remember. The strength meter shows the actual entropy in bits rather than a vague “strong” label.

Unlike every other tool on this site, this one deliberately records nothing: generated passwords are not added to the draw history, not saved to browser storage and not written anywhere you could accidentally leave them.

How to use it

1. Choose Password or Passphrase.
2. For a password, set the length and tick the character sets you need.
3. For a passphrase, choose the number of words and a separator.
4. Press Generate — or Regenerate until you get one you like.
5. Copy it straight into your password manager.

How the random selection works

Every character and every word is chosen with a rejection-sampled index over crypto.getRandomValues(), so the selection is uniform and unpredictable. Passwords are built by guaranteeing one character from each selected set, filling the remaining length from the combined alphabet, and then shuffling the whole thing with Fisher-Yates — so the guaranteed characters are not always in the same positions.

The full algorithm — including the rejection-sampling step and the wheel stop-angle calculation — is written out on the methodology page.

Practical examples

• Creating a unique password for a new account.
• Generating a passphrase for a device or disk encryption key.
• Producing a temporary password to hand over in person.
• Making a set of distinct passwords for shared test accounts.

Available options

• Passwords from 8 to 64 characters.
• Uppercase, digits and symbols, with lookalike characters excluded by default.
• Passphrases of 3 to 10 words with a custom separator.
• Entropy estimate in bits with a plain-language rating.
• One-press copy.

Privacy

This tool is intentionally more restrictive than the rest of the site. Generated passwords are never sent anywhere, never written to localStorage, never added to the draw history and never logged to the console. They exist only in the page until you copy them or close the tab. Even so, the safest place to generate a password is your password manager — use this when that is not available.

Full details are in the privacy policy, which also has a button that deletes everything this site has stored in your browser.

Fairness and limitations

Strength here means entropy, and entropy comes overwhelmingly from length. A 20-character lowercase password is far stronger than an 8-character password with every symbol you can find, and it is easier to type. The bit estimate assumes an attacker who knows exactly how the password was generated, which is the correct conservative assumption. On a browser without the Web Crypto API the tool falls back to Math.random() and warns you — do not use that fallback for real credentials.