How to use
Set length, character types, and count; choose a symbol rule (preset, whitelist, or blacklist) and press Generate. Each result can be copied or regenerated individually. Entropy-based strength is shown alongside.
Generates strong random passwords fully in your browser using CSPRNG (crypto.getRandomValues). Nothing is sent to any server. Symbols can be fine-tuned via preset / whitelist / blacklist to match any service policy.
Generated Passwords
Configure the options below and press "Generate".
Length / Count
16
Advanced options
Force a minimum count from each category. If sum exceeds length, values are auto-adjusted.
Character types
Symbol details
Mode
Actual symbol pool
Input, output, limits
Input: length (4–128), character types, symbol policy, count. Output: password, entropy (bits), estimated online crack time. Nothing is sent to a server or stored in an account. Requires Web Crypto in the browser.
Example
Length 16, upper+lower+digits+safe symbols. Each run is different, in the shape of K7#mP2qL!nR4wX9b.
Symbol policy (important)
Different services accept different symbol sets. Some allow only !@#$%^&*(), others forbid injection-risk chars like <>'"`\. The three modes (preset / whitelist / blacklist) let you match any policy exactly.
What makes a strong password
- Long: 12+ chars, 16+ for important accounts
- Random: no dictionary words, no repeated patterns, no personal info
- Unique: different per site, use a password manager
- Pair it with 2-factor authentication (2FA)
FAQ
Are generated passwords sent to the server?
No. They are created in the browser with crypto.getRandomValues and never uploaded.
Which RNG does this use?
The Web Crypto CSPRNG (crypto.getRandomValues). It does not use Math.random.
Can I match a site's symbol policy?
Yes. Preset, whitelist (only these chars), and blacklist (exclude these chars) cover strict service rules.
