ByteScope

Password Generator

Strong random passwords, passphrases and PINs — generated locally, never transmitted.

Your files never leave your browser — all processing is local.

Nothing you generate ever leaves this page

Uses crypto.getRandomValues — the browser's cryptographically secure random source — instead of Math.random, which is predictable and unsafe for secrets.

About this tool

This password generator runs entirely in your browser and uses crypto.getRandomValues — the cryptographically secure random number generator built into your browser — never Math.random. Pick a character set (upper/lower case, digits, symbols, with an option to exclude easily-confused characters like 0, O, 1, l, I), set the length, and generate as many candidates as you need at once.

Prefer something you can actually remember? Passphrase mode draws 4–8 words from the EFF long wordlist — the "correct horse battery staple" approach — which trades a longer string for far easier memorization at equivalent strength. A PIN mode covers numeric codes. Every result shows its entropy in bits alongside a plain-language estimate of how long an offline brute-force attack would take.

Unlike most online password tools, this page loads no third-party generator scripts and the generator itself makes zero network requests — you can verify in your browser's DevTools Network tab that generating a password sends nothing. (The only requests on the page are the site's cookieless page-view beacon, which carries no generated data.) Generated passwords are held only in memory: nothing is stored, and refreshing the page erases the history.

Frequently asked questions

Is it safe to generate a password on a website?
It depends entirely on where the randomness comes from and where the result goes. This page generates passwords with your browser's built-in CSPRNG (crypto.getRandomValues), and the generator makes zero network requests — generating and copying a password sends nothing anywhere, so the password exists only on your machine. You can confirm with the DevTools Network tab: the only traffic on this page is the site's cookieless page-view beacon, which never sees your passwords.
Why crypto.getRandomValues instead of Math.random?
Math.random is a fast pseudo-random generator designed for games and animations — its output is predictable enough that it must never be used for secrets. crypto.getRandomValues is a cryptographically secure random source seeded by the operating system, which is what password generation requires.
What is a passphrase and when should I use one?
A passphrase strings together random words from a fixed wordlist (this tool uses the EFF long list: 7,776 words, ~12.9 bits of entropy per word). A 5-word passphrase (~64 bits) is comparable in strength to a 10-character mixed-symbol password but is far easier to type and remember — ideal for master passwords you must memorize.
How is the crack-time estimate calculated?
From the entropy: a password chosen uniformly from N possibilities takes on average N/2 guesses. The estimate assumes an offline attacker testing 10 billion guesses per second (a realistic GPU rig against fast hashes) — real times vary hugely with how the service stores passwords, so treat it as an order-of-magnitude guide.
Are generated passwords stored anywhere?
No. Results live only in this tab's memory so you can compare a few candidates; there are no cookies, no localStorage entries, and nothing is sent anywhere. Reloading the page clears everything.