How to generate random passwords

The generator builds passwords from the browser's cryptographic random source: choose a length between 1 and 99 characters, how many you need at once (up to 500), which of the four character sets to draw from — digits (10), lowercase (26), capitals (26) and punctuation (32) — and whether a character may appear twice inside one password.

Every run happens in the page. The list appears as plain text, Copy puts the generated values on the clipboard one per line, and the punctuation characters arrive exactly as they were drawn.

  1. Tick the character sets you want. Digits, lowercase and capitals are on by default; punctuation adds 32 symbols such as ` ~ ! @ # $ % ^ & * ( ) - _ = + [ { ] } \ | ; : ' " < . > / ?
  2. Set the length (1–99) and the number of passwords (1–500). A larger value is capped, and the status line names the cap instead of changing your setting silently.
  3. Tick Do not repeat characters to use each character at most once per password; if the requested length is longer than the selected pool, the status line reports the shorter length that was used.
  4. Press Generate passwords. The status line reports how many passwords of which length were generated, together with any correction the run had to make.
  5. Press Copy Result to put the list on the clipboard, or Clear to empty the result and the status line before the next run.

What the generator does, and what it leaves to you

Where the randomness comes from

Characters are drawn with crypto.getRandomValues and rejection sampling: a raw 32-bit draw is discarded whenever it would make some characters more likely than others, so each position is uniform over the selected set.

There is no fallback to a predictable source. A browser without Web Crypto gets a sentence saying that nothing was generated, and the result stays empty.

Length, batch size and the no-repeat option

One run produces between 1 and 99 characters per password and up to 500 passwords. Above those values the run is capped and the status line says which cap was applied.

With no repeated characters a password can only be as long as the pool it draws from: 94 characters with all four sets, 62 without punctuation, 10 with digits alone. A longer request is shortened to the pool size and reported.

What the page does not do

It does not score password strength, compare the result against a policy or a breach list, or keep a history: the list stays in the page until you reload it or press Clear.

Storing the password is still your job. Put it into your password manager before the tab is closed, and use a separate password for every account.

Recent tools: