Introducing Password Generator: Cryptographically Secure Passwords in Your Browser
Password Generator creates strong, random passwords using the browser's built-in cryptographic random number generator. Set your length and character preferences, and get a password that's genuinely hard to guess — all without sending anything to a server.
Why Randomness Source Matters
Many simple password generators use JavaScript's Math.random() — which is not cryptographically secure. It's seeded from predictable values and its output can, in theory, be reverse-engineered. Our tool uses crypto.getRandomValues(), the same entropy source used for cryptographic key generation. This is the correct tool for the job when generating secrets.
Customisation Options
You can set password length from 4 to 128 characters via a slider. Character sets are individually toggleable: uppercase letters, lowercase letters, numbers, and symbols. There's also an option to exclude visually ambiguous characters — specifically 0, O, l, 1, I — which is useful when a password needs to be read and typed manually rather than pasted.
Strength Indicator
A strength bar and label update in real time as you change settings. The score is based on length thresholds and the mix of character types: a 20-character password using all four character sets scores "Very Strong", while a short numeric-only password scores "Weak". The metric is a heuristic, not a guarantee — but it gives a practical sense of relative strength.
Bulk Generation
The bulk generate feature lets you produce up to 100 passwords at once with the current settings. Each one is independently generated from a fresh call to crypto.getRandomValues(). The results are displayed in a monospaced block and can be copied all at once. This is useful for seeding test accounts, generating API keys for a batch of users, or pre-generating one-time codes.
Privacy
The tool is entirely client-side. No password generated here is ever transmitted anywhere. The page itself is served as a static file — there is no server-side component, no analytics on what settings you use, and no logging of generated passwords.