Random Password Generator
Strong random passwords with full control over length and character sets.
$ pwgen -s 20 1
What makes a password strong?
Length beats cleverness. Every extra character multiplies the number of possible passwords, so a 20-character random password from the full 94-character set carries about 131 bits of entropy — far beyond what any brute-force attack can search. Substituting a with @ in a dictionary word, on the other hand, adds almost nothing: cracking tools try those substitutions first.
How this generator works
Characters are drawn with crypto.getRandomValues(), the cryptographically secure random number generator built into your browser — never Math.random(). The generator uses rejection sampling, so every character in the selected set is exactly equally likely (no modulo bias). Generation happens entirely on your device: open your browser's network tab and you'll see that no generated value ever leaves the page.
Practical advice
Use a password manager and give every account its own random password — the one case where you should prefer a passphrase is the handful of secrets you must type from memory, like the password manager's master password. The "no ambiguous characters" option removes 0/O and 1/l/I, which helps when a password has to be read aloud or retyped from paper.
How long should a password be?
For anything stored in a password manager, 16 characters from the full set is already far beyond brute-force reach (about 105 bits of entropy) and 20 gives you 131 bits. Length buys far more than cleverness: adding one character multiplies the search space by 94, while swapping a for @ in a dictionary word adds almost nothing, because cracking tools try those substitutions first.
Are these passwords really random?
Every character is drawn with crypto.getRandomValues(), your browser's CSPRNG, using rejection sampling — so each character in the selected set is exactly equally likely, with no modulo bias. Math.random() is never used anywhere on this site.
Should I turn symbols off?
Only if something forces you to. Some legacy systems reject punctuation, and some passwords have to be typed on a phone keypad or read aloud. Dropping symbols costs you about 0.6 bits per character — compensate by adding two or three characters and you are back where you started.
Nothing leaves your browser
- Don't take our word for it — turn off your wifi. Every generator on this site keeps working with the network disconnected. That's the whole proof, and it takes five seconds.
- Every value comes from
crypto.getRandomValues()— the CSPRNG built into your browser, neverMath.random(). - Generated secrets are never transmitted, logged or stored: no server-side generation, no cookies, no localStorage.
- Verify it yourself in the network tab: after loading, the page only talks to our self-hosted, cookie-less analytics — which counts page views and which generator type gets copied, never any value.
- Strict Content-Security-Policy; no third-party script origins.
All generators
- Base64 Secret Generator
- UUID Generator
- Hex Secret Generator
- JWT Secret Generator
- Passphrase Generator
- SSH Key Generator (Ed25519)
- PIN Generator
- WireGuard Key Generator
- API Key Generator
- TOTP Secret Generator
- Django SECRET_KEY Generator
- Laravel APP_KEY Generator
- NextAuth Secret Generator
- Flask SECRET_KEY Generator
- Rails secret_key_base Generator
- Strapi APP_KEYS Generator
- ULID Generator
- Nano ID Generator