Password Generator creates random passwords using the Web Crypto API — the same crypto.getRandomValues() source that browsers use for TLS session keys. That matters because Math.random() is a predictable PRNG; given enough outputs, its internal state can be reconstructed and future values predicted. This tool uses a cryptographically secure source with rejection sampling, so every character has a truly uniform probability across your chosen pool with no modulo bias.
You control the recipe: length from 8 to 128 characters, and independent toggles for uppercase, lowercase, digits, and symbols. The exclude-ambiguous option strips lookalike characters — 0/O, 1/l/I, backtick, pipe — which saves real pain when a password gets read over the phone or typed off a sticky note into a server console. The generator also guarantees at least one character from every enabled set, so a 12-character password with symbols on will actually contain a symbol.
Everything runs 100% client-side in your browser. No password ever touches a network request, a server log, or an analytics event — you can verify that yourself in DevTools' Network tab, or just cut your connection and keep generating. The built-in strength meter shows entropy in bits alongside an estimated offline crack time at 10 billion guesses per second, which is a realistic figure for a GPU rig attacking a fast hash like MD5 or NTLM.
Drag the slider anywhere from 8 to 128 characters. For most accounts, 16-20 characters is a sweet spot: comfortably past the point where brute force is infeasible, but still short enough to type manually when a password manager is not an option. Length beats complexity — each extra character multiplies the keyspace.
Toggle uppercase, lowercase, numbers, and symbols independently. Enable "exclude ambiguous" if the password will ever be transcribed by hand — it removes 0/O, 1/l/I and similar lookalikes. Some legacy systems reject certain symbols, so if a signup form keeps complaining, try turning symbols off and adding four characters of length instead.
Hit Generate and watch the strength bar. It reports entropy in bits and an estimated crack time assuming an offline attacker running 10 billion guesses per second. Anything showing "centuries" or better is fine for real-world use. If you want options, switch to batch mode and generate five candidates at once.
Click the copy button next to any password to put it on your clipboard, then paste it straight into your password manager. Do not reuse it across sites — a breach of one service turns a shared password into a skeleton key for every account that uses it.
Uses crypto.getRandomValues() with rejection sampling — no Math.random() predictability, no modulo bias
Independent toggles for uppercase, lowercase, digits, and symbols, with length from 8 to 128 characters
Optionally strip lookalikes like 0/O and 1/l/I for passwords that need to survive being read aloud or handwritten
Shows entropy in bits and a realistic crack-time estimate at 10 billion guesses per second
Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes from any text
Decode JWT headers and payloads, inspect claims, and check token expiry
Generate random UUIDs (Universally Unique Identifiers)
Encode and decode text to/from Base64 format
0 comments
No comments yet. Be the first to share your thoughts!