Tool 003 / dev / free / runs locally
Password Generator
Build a strong, random password with the character sets and length you choose. The generator uses your browser's cryptographic random number source and shows a real-time strength estimate. Nothing is sent over the network.
How it works
This password generator builds a random string from the character sets you enable: uppercase, lowercase, digits, and symbols. The randomness comes from window.crypto.getRandomValues, the browser's cryptographically secure random source, not Math.random. Each character is an unbiased pick from the combined alphabet, so the result is suitable for real account passwords and secrets.
The strength meter is not a guess based on rules of thumb. It computes entropy directly as length times log2(alphabet size), which is the number of bits an attacker would have to search. A 20-character password drawn from all four sets (about 92 symbols) carries roughly 130 bits, which the meter labels Very strong. Turn sets off and the alphabet shrinks, so the same length gives fewer bits.
Everything is generated locally and never transmitted or stored. The password exists only in your tab until you copy it. Closing or refreshing the page discards it, so copy it into your password manager before navigating away.
How to use it
- Set the length with the slider, anywhere from 6 to 64 characters.
- Tick the character sets you want: uppercase, lowercase, digits, symbols.
- Read the strength estimate; aim for the Strong or Very strong band.
- Click Copy to put the password on your clipboard, or Regenerate for a fresh one.
Worked examples
Input: Length 20, all four character sets enabled
Output: A 20-character mix such as gT4!xQ9w#Lm2$Vz7&Ab1, rated about 130 bits (Very strong).
All four sets give an alphabet of roughly 92 characters.
Input: Length 8, lowercase only
Output: An 8-character string like qwbnmlra, rated about 37 bits (Weak).
A small alphabet and short length produce a low-entropy password.
Edge cases and limits
- Entropy is rounded to the nearest bit for display. The labels (Weak under 40, Fair under 60, Strong under 90, Very strong above) are thresholds, not guarantees against every attack model.
- Because every character is independent and random, a result can occasionally lack one of the enabled sets (for example no symbol). If a site requires at least one of each, regenerate or add the missing type by hand.
- Deselecting every set produces an empty password and a None rating; at least one set must be on.
Common mistakes
- Choosing a short length for the sake of memorability. Length adds more entropy than swapping a letter for a symbol; prefer 16 or more and store it in a manager.
- Reusing one generated password across sites. The value of a random password is per-site uniqueness, so one breach does not cascade.
- Disabling symbols because a site once rejected them, then using that habit everywhere. Only restrict sets when a specific site forces you to.
Frequently asked questions
How long should a strong password be?+
Aim for at least 16 characters with a mix of letters, numbers, and symbols. Shorter passwords (under 12) are increasingly brute-forceable. Length matters more than complexity.
Is this generator cryptographically secure?+
Yes. It uses window.crypto.getRandomValues(), which the browser backs with a CSPRNG. That's the same source recommended for security-sensitive use cases.
Should I reuse a generated password across accounts?+
No. The whole point of a unique random password is per-site uniqueness: if one site leaks, the others are still safe. Use a password manager to store them.
Related tools
More Developer tools that run entirely in your browser.