Generate cryptographically secure random passwords. Customize length, character types, and generate in bulk. Nothing is ever stored or sent anywhere.
Data breaches expose millions of passwords every year. Using weak or reused passwords is one of the biggest security risks for individuals and businesses. A strong, unique password for each account — combined with a password manager — is the most effective protection.
Logrith's password generator uses cryptographically secure randomness (the Web Crypto API) to ensure no pattern can be predicted. Unlike online generators that might log your requests, this tool generates everything locally in your browser — your passwords never leave your device.
Not all "random" is equally secure. Many simpler random number generators, including JavaScript's standard Math.random(), are designed for general-purpose randomness like games or shuffling — not for security-critical applications. Given enough observed output, some of these generators can theoretically be predicted by an attacker who understands the underlying algorithm. The Web Crypto API's crypto.getRandomValues(), which this tool uses, is built specifically for security purposes, drawing from the operating system's cryptographically secure random source — the same category of randomness used for generating encryption keys. This is a meaningfully stronger foundation for something as sensitive as a password.
Password strength comes down to how many possible combinations an attacker would need to try before guessing correctly, a value that grows exponentially with length and with the size of the character set used. A 20-character password drawing from uppercase, lowercase, digits, and symbols has an astronomically larger number of possible combinations than an 8-character password using only lowercase letters — length matters more than people often assume, which is why this tool defaults to 16 characters and allows up to 128.
The strength indicator on this page scores a password based on several factors together: total length, and whether uppercase letters, lowercase letters, numbers, and symbols are each present. Longer passwords that combine all four character types score highest, since both the length and the variety of possible characters at each position increase the total number of combinations an attacker would need to try. A password scoring "Weak" or "Fair" is still randomly generated and not guessable through dictionary-based attacks, but a few additional characters or an additional character type pushes it meaningfully further out of reach of brute-force attempts.
Some character combinations are visually confusing, especially in certain fonts: the digit zero (0) versus the uppercase letter O, or the digit one (1) versus lowercase L (l) versus uppercase I. If a password needs to be typed manually from a printed copy, read aloud over the phone, or entered on a device with a small or unclear keyboard, removing these ambiguous characters reduces the chance of a transcription error. For passwords that will only ever be copy-pasted from a password manager, this setting matters less, since there's no manual typing involved to introduce errors.
The bulk generator is useful whenever you need many independent passwords at once rather than one — setting up a batch of new accounts, generating temporary credentials for a team, or creating test data for a development environment. Every password in a bulk batch is generated independently using the same cryptographically secure method as the single generator, so there's no reduction in randomness or security when generating larger batches.
A password generator that sends your input or output to a remote server — even briefly, even without storing it — introduces a point of exposure that simply doesn't need to exist for a task like this. This tool generates every password entirely within your browser; nothing about the characters you select, the length you choose, or the passwords produced is ever transmitted anywhere. The history list shown on this page lives only in your browser's memory for the current session and disappears the moment you close or refresh the tab, with no copy retained anywhere else.