Password Generator

Drawing uses your browser’s cryptographic random source, the same family of API as the random number generator. Nothing is sent to a server. Click Generate — a password is not created until you ask. Reset or a reload clears the string from the page.

This is a convenience generator, not an audited password manager or hardware token. Store the result in a manager you trust. Estimated entropy is length × log2(charset size), an upper bound for a uniform independent draw. A unique password per site matters more than memorizing one clever phrase — generate here, save there, and turn on two-factor authentication for email and banking. Length must be at least 4 so each enabled set can contribute one character; 128 is the cap. Look-alikes 0, O, 1, l, and I are dropped only when you choose Exclude.

Each enabled set contributes at least one character so a 12-character “letters + digits” password cannot accidentally be letters only. The string is then shuffled.

The generator picks one character from each enabled set, fills the remaining length from the full charset, then shuffles with cryptographic random indexes. A failed random draw aborts instead of falling back to Math.random.

More length and a larger charset raise the estimate. Excluding look-alikes slightly lowers charset size.

A unique password per site matters more than memorizing one clever phrase. Generate here, store there, and enable two-factor authentication on important accounts. If a site rejects some symbols, turn symbols off and add a few extra characters of length instead of recycling an old password. Click Generate again for a new draw; previous strings stay only in whatever you copied. Nothing is uploaded: drawing uses the browser’s cryptographic random source, and a failed draw aborts instead of falling back to Math.random. Estimated entropy is an upper bound for a uniform independent draw — it is not a certified module or a substitute for a hardware token.