Settings
About the Password Generator
Generate strong random passwords using the browser Web Crypto API, which provides cryptographically secure randomness rather than the predictable output of Math.random. Set the length, choose which character sets to include, and generate one password or a batch. Nothing is stored, logged or transmitted — the password exists only in your browser until you copy it.
How to use the Password Generator
-
Set the length
Longer is stronger, and length matters more than complexity. Sixteen characters or more is a reasonable baseline for an account you care about.
-
Choose character sets
Toggle uppercase, lowercase, numbers and symbols. Some systems reject certain symbols, so you can turn them off when a site is restrictive.
-
Generate and copy
Produce one password or several at once, then copy the one you want straight into your password manager.
When to use it
Creating a new account
Generate a unique password instead of reusing one, so a breach at one service does not compromise the others.
Rotating a compromised credential
Replace an exposed password immediately with a strong random value.
Provisioning service accounts
Generate a batch of distinct credentials for API users or database roles in one pass.
Frequently asked questions
Are these passwords actually random?
They use crypto.getRandomValues from the Web Crypto API, which is a cryptographically secure random source — unlike Math.random, whose output is predictable and unsuitable for secrets.
Is the generated password stored or sent anywhere?
No. It is generated in memory in your browser and never written to storage or transmitted. Closing the tab discards it, so copy it into a password manager first.
How long should a password be?
At least 16 characters for accounts that matter, and longer where the system allows. Adding length increases the search space faster than adding character types.
Is it safe to generate passwords in a browser?
The randomness is sound, but the surrounding environment matters. On a shared or possibly compromised machine, a malicious extension could read the page. Generate credentials on a device you trust.
Should I use a passphrase instead?
A long random passphrase can be equally strong and much easier to type where you must enter it manually. For anything stored in a password manager, a random string is fine since you never type it.
Related tools
Browse all free online tools on Tooly — every one runs in your browser, with no account required.