Password Generator
Generate strong random passwords with the Web Crypto API. Choose length and character sets, or switch to a 4-digit PIN.
Loading tool…
How It Works
The generator produces passwords by drawing random bytes from crypto.getRandomValues, the browser's cryptographically secure random number generator — the same CSPRNG that issues TLS session keys. Nothing is sent anywhere: the bytes are generated, mapped to characters and displayed entirely on your device, and the tool keeps working offline after the page has loaded.
You control two things: length, from 4 to 64 characters with a default of 16, and a character-set preset. Seven presets are available — letters, numbers and symbols; letters and numbers; letters only; lowercase only; uppercase only; numbers only; and symbols only (!@#$%^&*). The 4-digit PIN used elsewhere on this site is simply the numbers-only preset at length 4.
Mapping bytes to characters is where many generators quietly go wrong. The naive approach — take each random byte and compute byte % charsetSize — is biased whenever 256 is not divisible by the charset size: with the 70-character default set, some characters would come up four times as often as others per 256 bytes. This tool uses rejection sampling instead: byte values that would introduce bias are discarded and redrawn, so every character in the chosen set is exactly equally likely.
Entropy depends on both settings. A 16-character password from the full 70-character set carries roughly 98 bits, which no realistic attack enumerates; an 8-digit numbers-only password carries only about 26.6 bits, appropriate for a device PIN but not for an account.
How to generate a password
- Pick a character-set preset — the full set suits accounts, numbers-only suits PINs.
- Slide the length: 16 for everyday accounts, more where accepted.
- Click generate; every click draws fresh randomness, so regenerate until you have one you will store immediately.
- Save the result in your password manager before leaving the page — output is never persisted.
Entropy by preset at length 16
| Preset | Character pool | Approx. entropy |
|---|---|---|
| Letters, numbers and symbols | 70 | 98 bits |
| Letters and numbers | 62 | 95 bits |
| Lowercase letters | 26 | 75 bits |
| Numbers only | 10 | 53 bits |
| Symbols only (!@#$%^&*) | 8 | 48 bits |
Examples
Input
Length: 16; character set: letters, numbers and symbolsOutput
k$9mQ2!vL8pR4zT@ (example shape — every click produces a new one)The default: 16 characters drawn equally from all 70 allowed characters.
Input
Length: 4; character set: numbers onlyOutput
0417 (example — leading zeros are possible and valid)The 4-digit PIN preset: uniformly random over 0000–9999.
Input
Length: 8; character set: symbols onlyOutput
Example output: !@#$%^&* — exactly 8 characters from !@#$%^&*Boundary: symbols-only builds passwords from the 8-symbol set.
Input
Length: 100Output
Error: Length must be an integer between 1 and 64Boundary: lengths beyond the 64-character maximum are rejected with an error, not truncated.
Frequently Asked Questions
- Is the password generation secure?
- Yes. Randomness comes from crypto.getRandomValues, the browser's cryptographically secure generator, and byte-to-character mapping uses rejection sampling so no character in your chosen set is more likely than another. Nothing is transmitted or logged.
- How do I generate a 4-digit PIN?
- Pick the numbers-only character set and slide the length to 4. That yields a uniformly random PIN between 0000 and 9999 — leading zeros included. The dedicated random 4-digit PIN generator page opens with those settings pre-applied.
- How long should my password be?
- For accounts, 16 characters from the full set (letters, numbers and symbols) is a comfortable default. Longer is better where accepted: 32 or 64 characters add entropy at no cost since you never type them by hand — your password manager does.
- Can the tool run out of randomness or repeat itself?
- Practically no. The generator redraws whenever a batch of random bytes is exhausted or biased, and the chance of two 16-character full-set passwords colliding is far below one in a trillion trillion. Clicking generate repeatedly always yields fresh output.
Limitations & Accuracy
Length is bounded between 4 and 64 characters. The tool does not score strength — it never checks your password against dictionaries or keyboard patterns, so judge entropy by length and set size: numbers-only output at short lengths is PIN-grade, not account-grade. The symbol set is limited to !@#$%^&*, so some sites with wider symbol requirements will reject the result; regenerate with a different preset if needed.