MyAITools

100% client-side · free · no sign-up

Random Password Generator

Strong, cryptographically secure passwords generated on your device with the Web Crypto API. Nothing is stored, logged or transmitted — ever.

Click “Generate password”

Options

Privacy: passwords are generated with your browser's cryptographically secure random number generator (crypto.getRandomValues) and exist only in this tab. They are never stored, logged or sent anywhere — close the tab and they are gone.

This tool runs entirely in your browser. Nothing you type or generate is uploaded, stored or sent anywhere.

How to generate a strong password

Five steps to a password worth having.

  1. Set the length

    Drag the length slider — 16 characters is a strong default; use 20+ for a master password.

  2. Choose character sets

    Toggle uppercase, lowercase, numbers and symbols to match the site’s rules.

  3. Optionally exclude lookalikes

    Tick “Exclude ambiguous characters” if the password will ever be typed by hand.

  4. Generate

    Click “Generate password” — a fresh password appears with a strength indicator.

  5. Copy it immediately

    Click “Copy” and paste it into your password manager. Nothing is saved here.

What this tool does

This generator creates random passwords using your browser’s cryptographically secure random number generator (crypto.getRandomValues) — the same source of randomness browsers trust for encryption keys, not a predictable pseudo-random function. Each click produces an independent password drawn from the character sets you enable.

Length and character variety together determine strength. A 16-character password using all four sets has more possible combinations than any realistic attacker can enumerate; the on-screen strength meter reflects how your current settings stack up. The optional “exclude ambiguous characters” mode drops lookalikes (l, 1, I, O, 0) for passwords that humans occasionally have to read aloud or type.

Everything happens in this tab. The password exists only in your browser’s memory — it is never written to storage, never logged, never transmitted. Close the tab and it is gone, so copy it into a password manager first.

Key features

Cryptographically secure

Generated with the Web Crypto API — genuine randomness, not a guessable pattern.

6 to 64 characters

Set any length the target site allows; longer beats cleverer every time.

Four character sets

Uppercase, lowercase, numbers and symbols — toggle each to satisfy any password policy.

Ambiguous-character filter

Drop lookalikes like l/1/I and O/0 for passwords meant to be typed or read aloud.

Live strength meter

See the strength of your current configuration before you commit.

Nothing stored, ever

No storage, no logs, no transmission — the password lives only in this tab until you close it.

Practical use cases

  • New account sign-ups — generate a unique password per site so one breach cannot domino.
  • Replacing reused passwords — rotate old favourites that have appeared in data breaches.
  • Wi-Fi and router passwords — use the ambiguous-character filter for credentials guests must type.
  • Shared team credentials — generate something strong, store it in the team vault, retire the sticky note.
  • Answering “password must contain” rules — toggle sets until the site’s policy is satisfied.

Limitations and notes

  • This tool generates passwords; it does not store them. Pair it with a password manager, or you will be back here resetting accounts.
  • The strength meter is a heuristic guide, not a guarantee — length and uniqueness across sites matter more than any score.
  • Some legacy systems restrict which symbols they accept; untick Symbols and re-generate if a site rejects the password.
  • A strong password does not replace two-factor authentication — enable 2FA wherever it is offered.

Frequently asked questions

How random are these passwords really?

They are generated with crypto.getRandomValues — the same cryptographically secure source browsers use for encryption keys — not a predictable pseudo-random function.

Are the passwords stored or sent anywhere?

No. Generation happens in this tab, nothing is written to storage and nothing is transmitted. When you close the tab the password is gone (copy it first!).

How long should my password be?

16 characters with all character sets is strong for most accounts. For a master password, use 20+ characters or a passphrase.

Why exclude ambiguous characters?

If you ever need to read or type the password manually, removing lookalikes like l/1/I and O/0 prevents mistakes.

Is a 16-character password really enough?

With all four character sets enabled, a 16-character password has around 95 to the power of 16 possibilities — far beyond brute-force at any realistic scale. Length is the dominant factor: a long password beats a short “clever” one. Use 20+ for anything protecting everything else, like a password-manager master password.

Should I use symbols?

If the site allows them, yes — symbols enlarge the pool each character is drawn from. But never weaken length to add symbols: a 20-character letters-and-numbers password beats an 8-character one full of symbols.

What makes a password weak?

Predictability, not simplicity. Names, dates, keyboard walks (qwerty) and reused passwords fall to dictionary and credential-stuffing attacks regardless of how they score on a meter. Random generation plus one-password-per-site is the actual defence.

Can I generate a passphrase instead?

This tool generates random-character passwords, which are strongest per character. If you prefer a memorable passphrase, generate a long password here for the sites that matter, and consider four or five random words for the ones you must memorise.

QR Code Generator Timestamp Converter JSON Formatter Case Converter