Random Password Generator
Cmd/Ctrl+Enter regenerates. Passwords are never stored or shared via link.
Advertisement
Generate a random password using the Web Crypto API's cryptographically secure random number generator, with rejection sampling to avoid modulo bias. Choose length, character sets, and whether to exclude visually ambiguous characters, and see an entropy estimate for the result.
Frequently asked questions
- Is this actually secure, or just Math.random()?
- It uses the Web Crypto API's getRandomValues — a cryptographically secure random number generator, the same primitive browsers use for generating encryption keys. Math.random() is not cryptographically secure and should never be used for passwords or secrets.
- Why does the tool reject some byte values internally?
- To avoid modulo bias. Picking a character via "randomByte % charsetSize" skews toward lower values whenever 256 isn't evenly divisible by the charset size — true for almost every charset length here. Rejecting and re-rolling bytes that would introduce that skew keeps every character equally likely.
- What does the entropy estimate mean?
- It's length × log2(charset size) — roughly how many attempts a brute-force search would need. It assumes uniform random selection (true here) and does not account for smarter, pattern-aware attacks, so treat it as a lower bound on strength, not an absolute guarantee.
- Is my generated password stored or sent anywhere?
- No — generation happens entirely in your browser tab, and unlike this tool's settings (length, character sets), the generated password itself is never written to a shareable link or saved to local history. Nothing is ever sent to a server.
Advertisement