Random Password Generator
Generate truly random passwords powered by the Web Crypto API, the same cryptographic standard your browser uses for HTTPS. Every character is independently and equally probable.
Generated via crypto.getRandomValues() in your browser. Your password is never sent to our servers.
Why True Randomness Matters for Passwords
Not all "random" is equal. The randomness source determines how predictable a password is to an attacker.
| Property | Math.random() | crypto.getRandomValues() |
|---|---|---|
| Type | Pseudo-random (PRNG) | Cryptographically secure (CSPRNG) |
| Predictable from prior output? | Potentially yes | No |
| Suitable for passwords? | No | Yes |
| Documented as cryptographically secure? | No, explicitly not | Yes |
| Bias elimination? | Varies, often biased | Yes, with rejection sampling |
| Used by this generator? | Never | Always |
How This Generator Achieves True Randomness
Build the Character Pool
Your selected options (uppercase, lowercase, numbers, symbols) are combined into a character pool. With all types enabled, that's 92 printable ASCII characters.
Request Entropy from the OS
crypto.getRandomValues() fills a Uint8Array with bytes sourced from the operating system's entropy pool. It's the same randomness source used for TLS keys and browser UUIDs.
Eliminate Modulo Bias
Each byte is tested against a rejection threshold. Any value that would produce an uneven distribution is discarded and a fresh byte is drawn. This guarantees every character has an exactly equal probability of selection.
Shuffle with Fisher-Yates
To guarantee at least one character of each required type, the generator fills mandatory slots first, then randomly fills the rest. All positions are then shuffled using a CSPRNG-powered Fisher-Yates shuffle.
Why Random Beats Human-Chosen Passwords
Humans Are Predictable
Password-cracking tools use dictionaries, common patterns, keyboard walks, and leet-speak substitutions (@ for a, 3 for e). A password you think is creative is often easily cracked within minutes.
Full Entropy Per Character
A randomly generated password uses the full entropy of its character pool. A human choosing "randomly" draws from a much smaller implicit pool, reducing effective entropy even if the output looks random.
No Patterns to Exploit
Dictionary attacks, Markov-chain attacks and pattern-based attacks all fail against a truly random password. The attacker has no information advantage, so they must exhaustively search the full space.
Browser-Local Generation
The randomness happens inside your browser. The generated password is never transmitted, logged, or stored anywhere outside your device.
Frequently Asked Questions
A random password is one where each character is independently selected from a defined pool with equal probability, using a source of randomness that is completely unpredictable to any outside observer. Truly random passwords have no exploitable structure, making brute force the only viable attack vector.
No. Math.random() is a pseudo-random number generator (PRNG). Its output is deterministic given a seed value, and a sophisticated attacker who observes enough outputs may be able to predict future values. The ECMAScript specification explicitly states that Math.random() does not provide cryptographic security.
This generator never calls Math.random(). It uses crypto.getRandomValues() exclusively, which is backed by the OS cryptographic entropy pool.
Modulo bias occurs when you convert a random byte (range 0–255) to a character index using the modulo operator (%), but 256 is not evenly divisible by the pool size. For example, with a pool of 94 characters: values 0–93 map cleanly, but some characters in the range 0–67 would also be selected by values 94–161, making them twice as likely.
Our generator uses rejection sampling: any byte value in the biased range is discarded and a fresh byte is requested until an unbiased value is found. This costs a small amount of additional computation but guarantees perfectly uniform character selection.
The key differentiators of this generator: (1) It uses crypto.getRandomValues(), not Math.random(). (2) It uses rejection sampling to eliminate modulo bias. (3) All generation happens entirely in your browser, so your password never touches a server. (4) The source is transparent HTML, CSS and JavaScript with no obfuscation.
For a broader assessment: Are Online Password Generators Safe?
Yes. A randomly generated password is the gold standard for credentials. Its strength comes entirely from its length and the size of its character pool, not from secrecy of the generation method. The algorithm is not a secret. It is entirely open and browser-local.
Store the generated password in a reputable password manager (Bitwarden, 1Password, etc.) so you never need to memorise it or write it down.
Related Tools
Strong Password Generator
Same engine, 20-character default for maximum security margin.
Try it →Password Entropy Calculator
Calculate the exact entropy in bits of any password.
Calculate →Passphrase Generator
Word-based passphrases that are easier to memorise, still genuinely random.
Try it →Password Strength Checker
Test the strength and entropy of any password instantly.
Check →What Is a Random Password? (Guide)
The difference between random and pseudo-random, explained clearly.
Read →Password Generator (Home)
The main generator with bulk generation and all options.
Generate →