# Password Generator

> Generate strong random passwords with crypto.getRandomValues. Pick the length and character sets and see the entropy. Nothing leaves your browser.

Category: Security. This tool runs in your browser.

Open the interactive tool: https://www.devkult.com/tools/security/password-generator

## FAQ

### Is it safe to generate a password on a website?

This generator runs entirely in your browser using crypto.getRandomValues, the browser's cryptographically secure random number generator. Passwords are never sent over the network, logged or stored — you can go offline after the page loads and it keeps working.

### How long should a password be?

For accounts you keep in a password manager, 16–20 random characters from all four character sets gives well over 100 bits of entropy, far beyond the reach of brute force. Current NIST guidance (SP 800-63B) puts length ahead of complexity rules and asks sites to accept passwords of at least 64 characters.

### What does the entropy figure mean?

Entropy in bits measures how many guesses a brute-force attack needs: every extra bit doubles the work. A 20-character password drawn from all 89 characters here has about 129 bits. The figure only holds because the password is truly random — it says little about passwords people choose themselves.

### Does every password include each character type I select?

Yes. Candidates missing a selected set are discarded and redrawn, so passwords satisfy sites with composition rules while staying uniformly random among all passwords that qualify.

### Why exclude look-alike characters?

Characters like I, l, 1, O and 0 are easy to misread when a password is typed from paper or read aloud. Excluding them shrinks the alphabet slightly, so add a character or two to keep the same strength.

## More Security tools

- [JWT Decoder](https://www.devkult.com/tools/security/jwt-decoder.md): Decode and inspect JWT tokens — header, payload, and signature.
- [Hash Generator](https://www.devkult.com/tools/security/hash-generator.md): Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes locally in your browser.
- [Bcrypt Tester](https://www.devkult.com/tools/security/bcrypt-tester.md): Generate and verify Bcrypt password hashes securely.
- [UUID/ULID Generator](https://www.devkult.com/tools/security/uuid-generator.md): Generate bulk UUIDs (v4) and ULIDs for your applications.
- [Security Headers Generator](https://www.devkult.com/tools/security/security-headers-generator.md): Pick your HSTS, CSP, framing and referrer settings and get ready-to-paste config for Next.js, nginx, Apache, Express, Vercel or Netlify.