Cryptographically random passwords. Generated in your browser, never transmitted.
Passwords are generated in your browser using cryptographic randomness. Nothing is transmitted or stored.
dwryB#cD-qr=g}RHItY5The first question to ask any password generator online is where the password is created. Here the answer is verifiable: every password is generated on your own machine using crypto.getRandomValues, the browser’s cryptographically secure random number generator, and nothing is transmitted or stored. There is no server that ever sees the result, which is the only acceptable design for a tool that creates secrets.
Cryptographic randomness matters because human-invented passwords and weak pseudo-random generators produce guessable patterns. This tool draws every character independently from a secure source and shows you the resulting entropy in bits, with a strength label from Weak to Maximum strength, so the security level is a number you can reason about rather than a vague meter. You control the recipe: length from 8 to 128 characters, and independent toggles for uppercase, lowercase, numbers, and symbols. Each generated password is guaranteed to include at least one character from every class you enable.
Two practical options round it out. Exclude ambiguous removes the characters 0, O, 1, l, and I that get misread when a password is printed or read aloud. And the quantity field generates up to 10 passwords in one batch — handy when provisioning several accounts — with one-click copy for each, or Copy all for the lot.
Drag the Length slider between 8 and 128 characters. Length is the biggest single factor in strength; 16 or more is a good baseline for important accounts.
Toggle uppercase, lowercase, numbers, and symbols. Every enabled class is guaranteed to appear at least once in each password.
Tick Exclude ambiguous to drop 0, O, 1, l, and I — useful for passwords that will be printed, displayed in some fonts, or read aloud.
Enter how many passwords you want (1 to 10) and click Regenerate. Each result shows its strength label and entropy in bits.
Use the copy icon next to a password or Copy all for the batch, then save it in a password manager rather than a plain text file.
Only if generation happens client-side. This tool creates passwords in your browser with the Web Crypto API and never transmits or stores them, so no server ever sees a password it produced.
At least 16 characters for anything important, drawn randomly from a large character set. Length beats complexity rules: each added random character multiplies the work an attacker faces, while substitutions like @ for a add almost nothing.
Entropy measures how many guesses an attacker would need: n bits means 2 to the power n equally likely possibilities. As rough guidance, under 40 bits is weak against offline attacks, while 80 or more bits is strong, and this tool shows the exact figure for your settings.
Only when a human has to read or type the password, for example from a printout or over the phone. Removing 0, O, 1, l, and I slightly reduces the character pool, so leave the option off for passwords that only ever live in a password manager.
Both can be strong; what matters is entropy and random selection. A 20-character random password from this tool exceeds 100 bits, while a four-word passphrase from a large wordlist gives roughly 50 bits. Use whichever you can store securely — ideally in a password manager either way.
Use a password manager, which encrypts your vault and fills credentials only on matching sites. Avoid plain text notes, spreadsheets, or reusing one generated password across several accounts.
ReSlug supports password-protected short links. Only people with the password reach the destination.