Password Generator
Runs in your browserA random password or secret, built on your browser's own CSPRNG. Nothing here is sent anywhere, and nothing is ever Math.random.
Result
152 bits · Very strongCharacters
How this one works
Every character comes from crypto.getRandomValues, the browser’s cryptographically secure random number generator — never Math.random, which is fast and predictable rather than secure. The bytes it returns are mapped onto your chosen character set with rejection sampling: any byte that would land unevenly across the set is discarded rather than reduced with %, so every character stays exactly as likely as every other one.
The bit count above is the real entropy of what you’ve configured — length times log₂(character set size) — not a strength meter guessing at it.
Questions
Is this actually secure, or just obfuscated?
It uses the same CSPRNG your browser gives WebCrypto and the operating system itself: crypto.getRandomValues. Nothing here is a homemade shuffle or a seeded PRNG dressed up to look random.
Does this reach a server?
No. Generation happens as JavaScript in this tab, and the result is never sent anywhere, copied only to your own clipboard when you ask.
Why exclude characters that look alike?
Reading a password back off a screen or a printout, 0 and O, or 1, l and I, are easy to mis-type. Turning this off gets you a very small amount of extra entropy back; on, it costs about 0.1 bits per character.
How long should this be?
For an account password, 16+ characters from all four sets clears 90+ bits, which is Strong here. For an API key or session secret you generate and store yourself, 32 is a comfortable default — the field defaults to that.