Is it safe to generate real account passwords with this tool?

The randomness comes from crypto.getRandomValues, the same CSPRNG browsers use for cryptography, so it's suitable for real passwords; still, use a password manager to store and autofill them rather than retyping from memory.

What's the difference between the password and key modes?

Password mode builds a string from character sets you choose (letters, digits, symbols) for humans to type or store; key mode outputs raw random bytes as hex or Base64, sized in bits, for use as an API key or encryption key.

Does this tool send generated passwords or keys anywhere?

No, generation happens entirely with crypto.getRandomValues inside your browser tab, and nothing you generate is transmitted, logged, or stored by the page.

Why does avoid ambiguous characters shorten my usable character set?

It removes characters that are easy to misread when handwritten or displayed in some fonts, specifically I, l, 1, O and 0, which slightly reduces the pool size and therefore the entropy estimate for a given length.

Password & Key Generator

Generate strong random passwords and encryption keys (hex/base64) in your browser.

Local, Runs entirely in your browser, your data never leaves your device.

Loading tool…

Generate passwords and encryption keys locally

This tool generates either a random password, built by picking characters from the sets you enable, or a random encryption key, output as hex, Base64 or Base64URL. Both draw from crypto.getRandomValues with rejection sampling so no character or byte value is biased. You can generate up to 500 at once, and passwords come with a rough entropy estimate in bits based on length and character-set size, computed as you type.

How to use the Password & Key Generator

Switch between Password and Key mode at the top.
For passwords, set the length (4-64) and toggle lowercase, uppercase, digits and symbols.
Optionally enable avoid ambiguous characters to drop lookalikes like l, 1, O and 0.
For keys, choose a bit length (128-512) and an encoding: hex, Base64 or Base64URL.
Set how many to generate at once, up to 500, and copy the results.

The entropy figure shown is a simple length × log2(pool size) estimate based on which character sets you enabled, not an analysis of the specific string produced; it assumes every character was chosen uniformly at random, which is true here since generation uses the CSPRNG.

Frequently asked questions

Is it safe to generate real account passwords with this tool?: The randomness comes from crypto.getRandomValues, the same CSPRNG browsers use for cryptography, so it's suitable for real passwords; still, use a password manager to store and autofill them rather than retyping from memory.
What's the difference between the password and key modes?: Password mode builds a string from character sets you choose (letters, digits, symbols) for humans to type or store; key mode outputs raw random bytes as hex or Base64, sized in bits, for use as an API key or encryption key.
Does this tool send generated passwords or keys anywhere?: No, generation happens entirely with crypto.getRandomValues inside your browser tab, and nothing you generate is transmitted, logged, or stored by the page.
Why does avoid ambiguous characters shorten my usable character set?: It removes characters that are easy to misread when handwritten or displayed in some fonts, specifically I, l, 1, O and 0, which slightly reduces the pool size and therefore the entropy estimate for a given length.