At a glance
| Length | 6 to 64 characters, default 16 |
|---|---|
| Character sets | Upper, lower, digits and symbols, each optional |
| Randomness | crypto.getRandomValues, not Math.random |
| Where it runs | Entirely in your browser — no file is uploaded to a server |
| Price | Free, with no account and no sign-up |
| Offline | Works with no connection after the first visit |
Where the randomness comes from
Every character is drawn from crypto.getRandomValues(), which is the browser’s interface to the operating system’s cryptographic random source. That matters: Math.random() is a fast pseudo-random generator meant for shuffling and animation, its output is predictable from a handful of samples, and it has no business anywhere near a password.
The characters are picked by rejection sampling rather than by taking a remainder. A plain modulo makes the first few characters of the alphabet marginally more likely than the last few — a small bias, but a needless one when avoiding it costs nothing.
Length beats complexity
Each extra character multiplies the search space; swapping an a for an @ does not. A 16-character password from a 72-character set is about 98 bits of entropy, which is far past anything an attacker will brute-force. A 10-character one with the same alphabet is around 61 bits, which is not.
Sixteen is a sensible floor for anything you care about, and 20 or more for the password to your password manager and your email — the two accounts that can reset everything else.
Reuse is the actual risk
Most accounts are not lost to brute force. They are lost because a password used somewhere else turned up in that site’s breach, and attackers try the same pair everywhere. A perfect password used twice is a weak password.
Which is the argument for a password manager rather than for cleverness: you only need to remember one, and every other password can be long, random and different.
Frequently asked questions
Is this actually random?
It uses crypto.getRandomValues(), the operating system’s cryptographic random source, not Math.random(). The difference matters — Math.random() output can be predicted from a short sample.
Is the password sent anywhere?
No. It is generated on your machine, never transmitted and never logged. Nothing about it exists outside your browser tab.
How long should a password be?
Sixteen characters for ordinary accounts, twenty or more for your email and your password manager. Length adds far more strength than substituting symbols for letters.
Should I avoid ambiguous characters?
Only if you will type it by hand or read it aloud — excluding l, I, 1, O and 0 helps then. If a password manager fills it in, keep the full alphabet.
Are passphrases better?
Easier to type and remember, and strong if genuinely random and long enough. Four or five random words beat a short scrambled string; two words do not.
Something wrong with this tool, or an idea for it? Tell us