Effective pool: 89 distinct characters
Nothing you generate ever leaves this page
Uses crypto.getRandomValues — the browser's cryptographically secure random source — instead of Math.random, which is predictable and unsafe for secrets.
Strong random passwords, passphrases and PINs — generated locally, never transmitted.
Your files never leave your browser — all processing is local.
Effective pool: 89 distinct characters
Nothing you generate ever leaves this page
Uses crypto.getRandomValues — the browser's cryptographically secure random source — instead of Math.random, which is predictable and unsafe for secrets.
This password generator runs entirely in your browser and uses crypto.getRandomValues — the cryptographically secure random number generator built into your browser — never Math.random. Pick a character set (upper/lower case, digits, symbols, with an option to exclude easily-confused characters like 0, O, 1, l, I), set the length, and generate as many candidates as you need at once.
Prefer something you can actually remember? Passphrase mode draws 4–8 words from the EFF long wordlist — the "correct horse battery staple" approach — which trades a longer string for far easier memorization at equivalent strength. A PIN mode covers numeric codes. Every result shows its entropy in bits alongside a plain-language estimate of how long an offline brute-force attack would take.
Unlike most online password tools, this page loads no third-party generator scripts and the generator itself makes zero network requests — you can verify in your browser's DevTools Network tab that generating a password sends nothing. (The only requests on the page are the site's cookieless page-view beacon, which carries no generated data.) Generated passwords are held only in memory: nothing is stored, and refreshing the page erases the history.
Need characters the built-in sets don't cover — a specific symbol, a character a site requires, or a non-Latin script? A custom-characters field adds anything you type to whichever built-in sets are enabled (duplicates are removed automatically, and the entropy estimate always reflects the true, deduplicated pool size, so the numbers stay honest). Generating for a team or a batch of new accounts? An Export CSV button turns the current batch of N results into a downloadable spreadsheet — built entirely in your browser with a Blob download, so the same nothing-uploaded guarantee covers the exported file too.
Yes — the custom-characters field adds whatever you type to whichever built-in sets you've enabled (or stands alone if you leave every toggle off). Duplicate characters are removed automatically, and the entropy and crack-time estimates are always computed from the actual deduplicated pool, so enabling it never inflates the numbers.
Yes — the Export CSV button turns the current batch (however many you generated at once) into a downloadable .csv file with columns for the password, its entropy in bits, and its strength rating. The file is built entirely in your browser via a Blob download; nothing is uploaded to produce it.
It depends entirely on where the randomness comes from and where the result goes. This page generates passwords with your browser's built-in CSPRNG (crypto.getRandomValues), and the generator makes zero network requests — generating and copying a password sends nothing anywhere, so the password exists only on your machine. You can confirm with the DevTools Network tab: the only traffic on this page is the site's cookieless page-view beacon, which never sees your passwords.
Math.random is a fast pseudo-random generator designed for games and animations — its output is predictable enough that it must never be used for secrets. crypto.getRandomValues is a cryptographically secure random source seeded by the operating system, which is what password generation requires.
A passphrase strings together random words from a fixed wordlist (this tool uses the EFF long list: 7,776 words, ~12.9 bits of entropy per word). A 5-word passphrase (~64 bits) is comparable in strength to a 10-character mixed-symbol password but is far easier to type and remember — ideal for master passwords you must memorize.
From the entropy: a password chosen uniformly from N possibilities takes on average N/2 guesses. The estimate assumes an offline attacker testing 10 billion guesses per second (a realistic GPU rig against fast hashes) — real times vary hugely with how the service stores passwords, so treat it as an order-of-magnitude guide.
No. Results live only in this tab's memory so you can compare a few candidates; there are no cookies, no localStorage entries, and nothing is sent anywhere. Reloading the page clears everything.