Is this actually cryptographically secure?

Yes. Every character comes from crypto.getRandomValues(), the same cryptographically secure random source used for keys and tokens, not Math.random(). Character selection also uses rejection sampling instead of a plain modulo, which avoids the slight bias toward earlier characters in the pool that a naive `randomByte % poolLength` would introduce.

What does the entropy number actually mean?

It's the Shannon entropy of the password given your settings, calculated as length × log2(pool size), in bits. It measures how much guessing an attacker with no other information would need to do; it does not measure whether a specific generated password happens to look weak by accident (e.g. all digits by chance).

Why exclude ambiguous characters?

The "exclude ambiguous characters" option removes characters that are easy to misread or mistype in certain fonts, like 1, l, I, 0, O, and |. It's useful for a password you'll need to type by hand or read off a screen, at the cost of a very slightly smaller character pool (and thus very slightly less entropy per character).

Does this tool store or transmit the passwords it generates?

No. Generation happens entirely in your browser, and nothing is logged, stored, or sent anywhere, refreshing the page discards everything.

Password Generator - Strong, Random Passwords

Overview

Introduction

A password's real strength comes from two things: how it was generated (truly random, not a pattern a human or a script would pick) and how long it is, not from memorable substitutions like "@" for "a".

This tool generates passwords from a cryptographically secure random source, with the character sets, length, and count you choose, entirely in your browser.

What Is Cryptographically Secure Password Generator?

A password generator built on the Web Crypto API's crypto.getRandomValues(), with configurable length, character sets, an option to exclude visually ambiguous characters, and bulk generation of multiple passwords at once.

It reports the resulting Shannon entropy in bits and a qualitative strength label, so you can see the effect of your settings rather than just trusting a generic "strong" label.

How Cryptographically Secure Password Generator Works

Each character is chosen by drawing a random byte from crypto.getRandomValues() and rejecting values that would introduce modulo bias, so every character in the selected pool has exactly equal probability rather than a naive `byte % poolLength` calculation's slight skew toward lower-value characters.

Entropy is calculated as length × log2(pool size); a larger character pool or a longer password both increase it, and the strength label simply buckets the resulting bit count.

When To Use Cryptographically Secure Password Generator

Use it whenever you need a new password for an account, and you're not relying on a password manager's own built-in generator.

It's also useful for generating placeholder credentials for test fixtures, demo accounts, or documentation examples, where you want something random but don't want to hand-type a fake-looking string.

Often used alongside Random String Generator, Diceware Passphrase Generator and UUID Generator & Validator.

Features

Advantages

Uses a real cryptographically secure random source, not Math.random(), for every character.
Rejection sampling avoids the modulo bias a naive implementation introduces, so every character in the pool is genuinely equally likely.
Reports entropy and a strength label so you can see the actual effect of your settings, not just a generic checkmark.
Generates multiple passwords at once, useful for provisioning several accounts in one pass.

Limitations

Generates independent random passwords; it doesn't check a generated password against breach databases or dictionaries.
A high entropy estimate assumes the attacker doesn't know your exact settings; sharing your exact character-set choices publicly slightly reduces the effective search space they'd need to try.

Examples

A 16-character password with all character sets

Input

length: 16, uppercase + lowercase + digits + symbols enabled

Output

qT8$mK2!vB9@zL3&

16 characters drawn from a pool of 26+26+10+25 = 87 characters gives roughly 16 × log2(87) ≈ 102 bits of entropy, well into the "Very strong" range.

Best Practices & Notes

Best Practices

Use a dedicated password manager to store generated passwords rather than reusing one you can memorize across multiple accounts.
Prefer length over complexity when a site allows it; a longer password with fewer required symbol types is often both easier to work with and higher-entropy.
Enable "exclude ambiguous characters" only when you expect to type or read the password manually; it very slightly reduces the character pool otherwise.

Developer Notes

Randomness comes from `crypto.getRandomValues()` on a single-byte `Uint8Array` per character, with rejection sampling against `256 - (256 % poolLength)` to discard bytes that would bias the result, then `% poolLength` on the accepted byte selects the character; this is the standard technique for unbiased random selection from a byte-oriented CSPRNG source.

Cryptographically Secure Password Generator Use Cases

Generating a new password for a personal or work account
Provisioning placeholder credentials for demo accounts or test fixtures
Generating several passwords at once when setting up multiple new accounts

Common Mistakes

Assuming a password with more symbol types is automatically stronger than a longer password with fewer types; length usually matters more than character-set variety.
Reusing a generated password across multiple accounts instead of generating a fresh one for each.

Tips

If a site rejects certain symbols, disable the symbols character set rather than manually editing the generated password, which would reduce its actual randomness.
Generate a few extra passwords at once (increase the count) when you know you'll be setting up several accounts in one sitting.

Cryptographically Secure Password Generator