🔐 Password Generator

⚠️

ℹ️ About Password Generator

Password Generator creates random passwords, word-based passphrases, numeric PINs and pronounceable passwords from a cryptographically secure random source. Every character, word and digit is drawn with crypto.getRandomValues using rejection sampling, so each pick is uniform over the selected set. Good randomness is the whole point of a generated secret: RFC 4086 covers randomness requirements for security, and current verifier guidance (length over composition rules) is published in NIST SP 800-63B.

Supported inputs

Generator type: Password, Passphrase, PIN or Pronounceable. The API exposes three endpoints, /api/tools/crypto/password-generator, .../password-generator/passphrase and .../password-generator/pin; pronounceable mode is the password endpoint with "pronounceable": true.
Password: length 4 to 128 characters (16 by default on this page, 12 via the API); character classes uppercase A-Z, lowercase a-z, digits 0-9 and the 11 symbols !@#$%&*+-=?, with at least one class enabled. Options: Exclude similar characters (removes 0 O 1 l I), Exclude ambiguous characters (strips {}[]()/\'"`~,;.<>, which only matters for an API customCharset, see Limitations) and No repeating characters. The API additionally accepts customCharset, a string that replaces the built-in classes.
Pronounceable: alternating consonant and vowel letters at the chosen length. Numbers, Symbols and Uppercase each overwrite one random position, so a result holds at most one digit, at most one of !@#$% and at most one capital (a later insertion can land on an earlier one). Exclude similar, Exclude ambiguous, No repeating and the API customCharset do not change the generated value in this mode, but they still feed the character-set size behind the reported entropy, so that figure describes the options you picked rather than the letters actually used.
Passphrase: 3 to 8 words on this page (3 to 10 via the API) joined by a hyphen, underscore, space, period or nothing (the API accepts any separator string); Capitalize each word; Add numbers appends one number from 10 to 9999; Add symbols appends one of !@#$%&*. The API also selects the wordList: common (64 entries of five to seven letters, 63 of them distinct, the page default) or simple (39 three- and four-letter words).
PIN: 4 to 20 digits (6 by default on this page, 4 via the API); No repeating digits (limits the length to 10) and No sequential patterns, which rejects any adjacent digits that differ by exactly 1, so 12, 65 and therefore 1234 never occur.
Quantity: 1, 5, 10, 25, 50 or 100 per click (the API clamps to 1 to 100; passphrases to 1 to 50).

Output

The page lists each generated value with its length; passwords also show the entropy in bits and passphrases their word count. Each row has a copy button, Copy All copies the whole batch one value per line, and Download saves the same lines as a .txt file. When a single password or pronounceable password is generated, a Strength Analysis panel shows the length, entropy, character-set size and a label from Very Weak to Very Strong (thresholds 30, 40, 50, 60 and 80 bits). The password API returns passwords[] with password, length and entropy, plus the normalized options and the charset (size and characters); the passphrase API returns passphrases[] with passphrase, words, length and wordCount; the PIN API returns pins[] with pin and length. Invalid combinations answer HTTP 400 with an error message.

Example

A 16-character password with uppercase, lowercase and digits enabled and symbols disabled ({"length": 16, "includeSymbols": false}) draws from a 62-character set, so every result carries the same entropy of 16 × log₂ 62: the JSON field is the unrounded 95.26714096619001 and the page displays 95 bits with the label Very Strong. One run returned oYds8JXFTcqxd7rd, and each password in such a batch contains at least one lowercase letter, one uppercase letter and one digit. With the same classes a 12-character password scores 71.45 bits (Strong) and an 8-character one 47.63 bits (Fair). The generated string itself differs on every run.

Limitations

Values are random and never stored, so a previous result cannot be regenerated; copy it into a password manager before leaving the page.
The built-in passphrase list is small: 64 entries (63 unique words), about 6 bits per word, so a 4-word passphrase carries roughly 24 bits from the words alone, far below a 7776-word Diceware list at 12.9 bits per word. Use 8 words plus the number and symbol options for anything sensitive, or a full Diceware list. No entropy figure is shown for passphrases or PINs.
Entropy is the theoretical value length × log₂(character-set size). It assumes uniform selection over the whole set and therefore overstates pronounceable passwords, which draw from 26 letters in a fixed consonant-vowel pattern plus at most one injected digit, symbol or capital.
One character from each enabled class is guaranteed and is drawn from the full class, so Exclude similar characters still leaves a 0, O, 1, l or I in about three results out of ten (roughly 29% with uppercase, lowercase and digits enabled, at any length).
Exclude ambiguous characters changes nothing with the built-in classes, because the symbol set !@#$%&*+-=? contains none of the ambiguous characters; it only filters an API customCharset. A customCharset still receives the guaranteed characters of every enabled built-in class, so disable those flags when using it.
No repeating characters fails when the length exceeds the character set (62 with letters and digits, 73 with symbols, 57 and 68 after Exclude similar); No repeating digits caps a PIN at 10 digits.
Passphrase batches are capped at 50 even when 100 is selected. This page creates new secrets only; to score an existing password use the Password Strength tool.

Browser or server processing

The interactive page runs entirely in your browser through the compiled logic module (password-generator.logic.js) and the Web Crypto API; no option and no generated value is sent to the server, so a password created here exists only in your browser tab until you copy it. The public API runs the same module in Node.js on the server and returns the values in the JSON response; requests are rate-limited (30 per minute for anonymous callers) and the tool-call log records the option names and request metadata (route, status, client IP), never the option values or the generated secrets.

FAQ

Is the password generated in my browser?

Yes. Clicking Generate calls the logic module already loaded in the page, and randomness comes from your browser's crypto.getRandomValues. Nothing is transmitted, so you can go offline after the page loads and keep generating; only direct calls to the API are processed on the server.

How long should a password be?

NIST SP 800-63B (Revision 4) requires at least 15 characters for a password used on its own, at least 8 when it is one factor of multi-factor authentication, and asks verifiers to permit at least 64; for a random secret, length matters far more than which classes are enabled. With letters and digits, 12 characters give about 71 bits and 16 characters about 95 bits, which is beyond practical offline guessing. Use the longest value the site accepts, use a different one for every account, API key, database and admin panel, and let a password manager type it for you.

Are generated passwords stored anywhere?

No. The page keeps the results in memory only until you generate again or navigate away, and nothing is written to cookies, local storage or the server. The API returns the values once and logs the request option names and metadata, never their values.

Why does it say the length cannot exceed the character set size?

No repeating characters means every character must be distinct, so the length is limited to the number of characters available: 62 with uppercase, lowercase and digits, 73 with symbols, fewer with Exclude similar. Lower the length, enable more classes or turn the option off. The same rule caps a no-repeat PIN at 10 digits.

References

API Usage Example:

POST /api/tools/crypto/password-generator
Content-Type: application/json

{
    "length": 16,
    "includeUppercase": true,
    "includeLowercase": true,
    "includeNumbers": true,
    "includeSymbols": true,
    "excludeSimilar": false,
    "quantity": 5
}

🔐 Password Generator

🔧 Generator Type

⚙️ Password Settings

📝 Passphrase Settings

🔢 PIN Settings

📊 Quantity

🎯 Generated

📊 Strength Analysis

💡 Security Tips