Password Generator
Cryptographically Secure // v1.0
Range: 4-64
Range: 1-10
Awaiting input...
What is a random password generator?
A random password generator builds a password from a uniformly random selection across the character sets you allow. RandomHub uses the browser's cryptographically secure Web Crypto API (window.crypto.getRandomValues) and rejection sampling to avoid modulo bias — the source of randomness is the same one most password managers rely on. You control length (4 to 64 characters), which character sets are in play (uppercase, lowercase, digits, symbols), and whether visually ambiguous characters (l, 1, I, O, 0) are filtered out. Generation happens entirely in your browser; the password is never sent over the network and never written to a log.
Who is the password generator for?
Privacy-conscious users
You manage your own credentials and want a generator you can audit (it is open and client-side) instead of trusting a vendor's "trust us, it's secure" black box.
IT admins & sysadmins
Provisioning service accounts, SSH key passphrases, database seeds, or one-off credentials for new hires. The 64-character cap covers anything short of full-entropy keys.
Developers
Quick disposable secrets for dev environments, test fixtures, mock auth flows, or sample data — when reaching for `pwgen` or `openssl rand` is more friction than a browser tab.
Parents
Setting up an account for a kid who has never had to remember a strong password. Generate one with ambiguous characters excluded so it can be read aloud and typed without confusion.
Self-hosters
Spinning up a self-hosted Vaultwarden, Nextcloud, Postgres or admin panel and need fresh credentials before you wire up a manager. Hit Generate, paste, move on.
Anyone whose vault gen is awkward
Some password managers tuck the generator behind menus or web extensions that fail at signup time. A trusted standalone tool removes the friction in that exact moment.
Why this password generator
Cryptographically secure source
Pulls bytes from window.crypto.getRandomValues — the same Web Crypto API that 1Password, Bitwarden, and modern browsers use. No Math.random anywhere in the pipeline.
No modulo bias
Naïve `random % poolSize` is biased toward lower indices when the pool size doesn't evenly divide the random source. We use rejection sampling against Uint32 to keep every character equally likely.
Strength meter in real bits
Entropy is computed as length × log₂(poolSize), the textbook formula. Buckets: weak <40 bits, fair 40–63, strong 64–95, fortress 96+. Your eyes can immediately see whether the configuration meets your target.
Stays in your browser
No network request is made when generating. We do not log, store, transmit, or analyze your passwords. Open DevTools and watch — the Network tab stays quiet on every Generate click.
Common scenarios with examples
New vault entry for a banking site
You signed up for a banking or government service that doesn't accept symbols. Set length 20, enable Upper / Lower / Digits, disable Symbols, and exclude ambiguous characters so the password is readable in printed receipts.
Settings: Length 20, Upper+Lower+Digits, Exclude ambiguous. Sample: "Tyek5JWXcbgjLE2EH3vk" — 20 × log₂(58) ≈ 117 bits, well into "fortress" range, alphanumeric-only as required.
SSH key passphrase
Your private key needs a passphrase you can type from memory once a day. Length 24, all sets, ambiguous off — high entropy and readable. Save into a password manager and stop trying to remember it.
Settings: Length 24, all sets enabled, Exclude ambiguous off. Sample: "K9$mZ#7vTq!4nL@8pR2&yX#W" — 24 × log₂(76) ≈ 150 bits. Strong enough to outlive the key it protects.
Disposable test account
You need a password for a throwaway account during dev. Length 12, lowercase + digits is enough; the account will be deleted in an hour.
Settings: Length 12, Lower+Digits only. Sample: "k7vmqr3z9fnp" — 12 × log₂(36) ≈ 62 bits. "Fair" range, fine for a 60-minute disposable.
Read-aloud password for a shared kiosk
You need a password that someone can read aloud while another person types it. Exclude ambiguous chars (no lowercase l, uppercase I, digit 1, uppercase O, digit 0) — kills the most common transcription errors.
Settings: Length 16, Upper+Lower+Digits, Exclude ambiguous on. Sample: "RvkP4hgWmFu82tNz" — 16 × log₂(58) ≈ 94 bits. Very close to "fortress", still readable in a noisy room.
How to use it
- 1.
Set the length
Pick 4 to 64 characters. 16 is a strong default for most accounts; 24+ for SSH passphrases or self-hosted root accounts.
- 2.
Choose character sets
Toggle Uppercase, Lowercase, Digits, Symbols. Each enabled set widens the pool size, which raises entropy per character. The tool guarantees at least one character from every enabled set in the result.
- 3.
Decide on ambiguous characters
Off (default): keep l, 1, I, O, 0 in the pool — slightly more entropy. On: filter them out — the password is easier to read aloud or transcribe by hand.
- 4.
Generate, then copy
Click Generate or press Enter. Each password has its own copy button; "Copy All" handles the multi-password case (1–10 at once). Use Show / Hide for shoulder-surfing protection if you're generating in public.
Frequently asked questions
Is this password generator actually secure?
The randomness comes from window.crypto.getRandomValues — the Web Crypto API, the same source 1Password, Bitwarden, and modern browsers use for their own generators. We use rejection sampling to avoid modulo bias. Generation is fully client-side: open DevTools, click Generate, and you'll see no network traffic.
What is "modulo bias" and why does it matter?
A naïve approach generates a 32-bit random integer and takes `n % poolSize`. When poolSize doesn't evenly divide 2³², some indices become slightly more likely than others. For passwords this leaks bits of entropy. We discard random samples that fall in the unbalanced tail and resample, so every character is equally likely.
How do you compute the strength in bits?
Entropy = length × log₂(pool size). A 16-character password using only lowercase+digits has 16 × log₂(36) ≈ 83 bits. The same length with all four sets and no ambiguous filter has 16 × log₂(94) ≈ 105 bits. The strength label thresholds are weak <40, fair 40–63, strong 64–95, fortress 96+.
Why exclude ambiguous characters?
l, 1, I, O, 0 are visually similar in many fonts. Filtering them helps when the password will be read aloud, transcribed onto paper, dictated over the phone, or shown on a kiosk display. The cost is a slightly smaller pool (and thus slightly less entropy per character) — usually a worthwhile trade.
Are passwords saved or sent anywhere?
No. Generation happens in JavaScript running in your browser. The page makes no network request when you click Generate. Nothing is logged, stored, transmitted, or analyzed. We can't recover a password you generated even if you ask — there is no record of it.
Why is the minimum length 4 instead of 8?
For most accounts you should use 12+. The 4-minimum exists because there are legitimate "PIN-style" use cases (door codes, app PINs, classroom games) where short numeric or alphabetic strings are explicitly what's needed. The strength meter will warn you when entropy is low.
What symbols are included when "Symbols" is on?
The set is `!@#$%^&*()-_=+[]{};:,.<>?/` — 26 characters. We exclude characters that commonly break form validation (backslash, single and double quotes, backtick, space) so the generated password works on a wide range of sign-up forms.
Can I generate a passphrase like "correct horse battery staple"?
Not currently — RandomHub generates character-based passwords. Diceware-style passphrases need a curated word list and are a different tool. If a passphrase generator is worth adding, that would be a separate page.
About strong random passwords
The strength of a password against brute force scales exponentially with its entropy in bits. A 12-character password drawing from 94 printable ASCII characters carries about 79 bits of entropy — already beyond what an offline attacker can crack within reasonable hardware budgets if the hash is properly stretched. Sixteen characters give roughly 105 bits, and 24 characters give about 158 bits, which is well past the practical security level of AES-128. The lesson from the last decade of password research is that length matters more than character class density. Adding a symbol to a 10-character password is a smaller win than extending the same password to 14 characters from a smaller class. RandomHub's defaults — length 16, all four sets, no ambiguous filter — sit comfortably in fortress range for most threat models. The tool is intentionally narrow: cryptographic randomness, configurable length and sets, an honest entropy meter, and nothing else. If a feature would noticeably improve the workflow without compromising the "stays in your browser" guarantee, write to us.
Related Random Tools
Related Random Tools
Continue with tools that match the same planning, classroom, writing, or game workflow.