secure password generator
Generate a password or an API secret at the length and character set you need, from the browser's cryptographic random source. Nothing is sent anywhere, and nothing is stored.
Runs in your browser — nothing is uploadedLength beats complexity
A longer password from a smaller alphabet is stronger than a short one with every symbol class forced in, and far easier to type. Composition rules mostly push people toward predictable substitutions. Length is what actually costs an attacker time.
Where the randomness comes from
This uses crypto.getRandomValues, not Math.random, which is not
cryptographically secure and is entirely predictable given enough output. Any generator built on
Math.random produces guessable secrets.
Generating in a web page
The value never leaves this page, but a browser is still a shared, extension-rich environment.
For a high-value production secret, prefer your password manager or openssl rand -base64 32 on a
machine you control. For test fixtures and throwaway accounts this is fine.
Questions
Is it safe to generate a password in a browser?
The generation itself uses a secure random source and nothing is transmitted. But a browser has extensions and other pages, so for a high-value production secret prefer a password manager or a local command line.
How long should a password be?
Longer is the single biggest factor. Aim for at least 16 random characters, or a passphrase of several random words, rather than a short one with forced symbol classes.
Are these passwords stored anywhere?
No. They are generated in the page and never sent or saved.
What is wrong with Math.random?
It is not cryptographically secure. Its output is predictable from enough samples, so anything it generates can be guessed.