About the Password / Secret Generator
A strong password or API secret needs to be long and genuinely random — not based on a pattern, dictionary word, or predictable substitution, all of which are the first things password-cracking tools try.
This tool generates cryptographically random passwords and secrets of a length and character set you choose, entirely in your browser.
How it works
- Set your desired length using the length control.
- Choose which character sets to include — lowercase, uppercase, digits, and symbols.
- Click Generate to produce a new random value; click again for a fresh one anytime.
Common use cases
- Generating a strong account password: Creating a long, random password with all character sets enabled for a new online account, to be stored in a password manager.
- Generating an API key or secret: Creating a long alphanumeric secret (digits and letters, no symbols) for use as an API signing key or environment variable.
- Setting a temporary admin password: Quickly generating a one-time strong password to hand off during account setup, to be changed on first login.
Frequently asked questions
How is randomness generated?
The tool uses `crypto.getRandomValues()`, the Web Crypto API's cryptographically secure random number generator, rather than `Math.random()`, which is not designed to be unpredictable enough for security-sensitive values.
How long should my password be?
Longer is generally better — most current guidance recommends at least 12-16 characters for account passwords, and often 20+ characters for secrets like API keys, since length is the single biggest factor in resisting brute-force attacks.
Should I include symbols in every password?
Symbols increase the character set size and therefore the search space an attacker must try, but some systems restrict which symbols are allowed — if a target system rejects certain symbols, generate a longer password using only the character sets it accepts instead.
Is it safe to generate a password in a browser tool like this?
Generation happens entirely client-side and the value is never transmitted anywhere, but as with any generated secret, copy it directly into a password manager and avoid leaving it in places like browser history, chat logs, or shared clipboards longer than necessary.
This tool runs entirely in your browser — nothing you enter is sent to a server. Read more in the Privacy Policy, or browse the full list of tools.