Password Generator
Choose length and character sets, then sample a browser-generated password with cryptographic randomness.
The page allows 4–128 characters so you can reproduce destination-specific rules. For real single-factor passwords, current NIST guidance requires verifiers to accept at least 15 characters as the minimum.
Generated Password
A generated value will appear here.
Generation settings
- Length
- 20
- Selected groups
- 4
- Alphabet size
- 84
- Every group required
- Yes
Handle the result as a secret
- Copying can leave the value in clipboard history or expose it to software that can read the clipboard.
- A random password cannot protect an account from phishing, malware, insecure recovery, or a compromised password manager.
Where randomness comes from
Characters are sampled locally with crypto.getRandomValues(). Rejection sampling avoids modulo bias. When the “every selected group” option is on, whole candidates are rejected until the generated password contains each group, instead of forcing characters into particular positions after generation.
Length and uniqueness do more work than decorative complexity
A machine-generated password is different from a human-chosen one: it does not need to be memorable, and it should not be reused. A longer independent value gives an attacker a larger space to search. Character-category requirements are often destination rules, not a substitute for sufficient length, secure storage, rate limiting, and phishing-resistant authentication where available.
Current NIST SP 800-63B guidance tells password verifiers not to impose composition rules on subscriber-chosen passwords. It instead emphasizes minimum length, acceptance of broad character sets, blocklists for common passwords, rate limiting, and salted password hashing. The group controls here exist because many real systems still impose their own acceptance rules.
Why the generator does not “pick one of each, then shuffle”
That common technique guarantees categories but changes the probability distribution: some final strings can be produced through more construction paths than others. This implementation samples complete candidates uniformly from the selected alphabet. If every group is required, it discards candidates that miss a group and samples again. The accepted strings therefore retain a clean, explainable random process.
Storage and recovery are part of password security
The generated value is only one piece of the account's security. Store unique credentials in a trusted password manager or an approved secret store rather than a note, source file, chat message, or screenshot. For application passwords stored by a server, the verifier should store a salted password hash using a suitable password-hashing scheme—not a reversible copy and not a fast plain SHA digest.
Current NIST password guidance
NIST SP 800-63B sets a 15-character minimum for passwords used as a single authentication factor, allows an 8-character minimum when the password is used only as part of multi-factor authentication, recommends permitting at least 64 characters, and rejects mandatory composition rules for subscriber-chosen passwords.