Random Password Generator

The random source is the whole thing

A password generator is only as good as its randomness. Many produce values from Math.random(), a fast pseudo-random generator that is not seeded unpredictably and was never designed to resist prediction; given enough output an attacker can reconstruct its state and derive every value it will produce. This tool uses crypto.getRandomValues(), the browser's cryptographically secure source, and samples the character set without modulo bias, which would otherwise make some characters quietly more likely than others.

Length beats complexity

Each additional character multiplies the search space; adding a character class only widens the base. A 20-character lowercase password has more entropy than a 10-character password using every class, and is far easier to type on a phone. When forced to choose, choose length.

Composition rules make passwords worse

Requiring one uppercase, one digit and one symbol pushes people toward predictable shapes: capitalise the first letter, append a digit and an exclamation mark. Cracking tools model that behaviour directly, which is why P@ssw0rd1 satisfies every rule and falls immediately. Current NIST guidance recommends allowing long passphrases and dropping mandatory composition rules for exactly this reason.

Reuse is the actual failure mode

Most account compromises are not cracked passwords; they are credential stuffing, where a password leaked from one breach is tried everywhere else. A unique password per site defeats that entirely, and that is only practical with a password manager. Generate, store it in the manager, and turn on multi-factor authentication, which holds even when the password is known.

Ambiguous characters

Excluding lookalikes such as l, 1, I, 0 and O is worth doing for any password that will be read aloud or typed from a screen. It shrinks the alphabet slightly, which one or two extra characters more than covers.

Nothing leaves the browser

Generation is local. No password is transmitted, logged or stored, and there is no server component that could keep one.