Corvo

Security

Strong Password Generator

Generate strong random passwords in your browser using your device’s own cryptographic randomness. Nothing is sent over the network.

Runs entirely in your browser. Nothing is uploaded.

Select a character type
—
Waiting

What this tool does

This generates a random password using your browser's cryptographic random number generator — the same class of randomness used for things like encryption keys, not the everyday Math.random() that powers things like shuffling a list. Pick a length and which character types to include, and it builds a password with a genuinely equal chance for every allowed character to appear at every position.

Nothing is sent anywhere. The password is generated, shown, and copied entirely inside your browser tab — and nothing about it is ever saved, not even locally. Your length and character-type preferences are remembered for next time, but the passwords themselves are never written to storage.

How to use it

  1. Set a length. Longer is stronger — there's rarely a good reason to go below 16 unless a site enforces a limit.
  2. Choose which character types to include. All four gives the largest pool and the strongest result per character.
  3. Check the strength readout below the password.
  4. Press Copy, or New for a different password with the same settings.

How the randomness actually works

Under the hood, this uses crypto.getRandomValues() to pull cryptographically secure random bytes, then maps each byte to a character using rejection sampling rather than a naive modulo operation. That distinction matters more than it might sound: byte % poolSize is subtly biased toward the lower end of the pool whenever 256 doesn't divide evenly by the pool size — which is almost always. Rejection sampling discards the small sliver of byte values that would introduce that bias, so every character genuinely has an equal chance of being picked.

When more than one character type is enabled, the generator also guarantees at least one character from each selected type appears somewhere in the password — placed at a random position, not a predictable one — rather than leaving it to chance. That matters because pure random selection from a combined pool can occasionally produce a password missing an entire category by chance, especially at shorter lengths, which would fail a site's "must contain a number" rule despite the generator being set up correctly.

A note on password managers

A tool like this is most useful paired with a password manager — generate a strong, unique password here for each site and let the manager remember it, rather than trying to remember dozens of strong passwords yourself. That combination is a meaningfully bigger security upgrade than a strong-but-reused password ever is, since reuse means one breach anywhere becomes a breach everywhere.

Questions

Is this actually secure, or just "random-looking"?

It's genuinely cryptographically random. The password is built using crypto.getRandomValues() — your browser's cryptographic random number generator, the same primitive real security software relies on — not Math.random(), which is fast but predictable and unsuitable for anything security-related. Character selection also uses rejection sampling to avoid modulo bias, so every character in the pool has a genuinely equal chance of appearing.

Does the password ever leave my browser?

No. It's generated, displayed, and copied entirely on your device. Nothing is sent anywhere, and nothing is saved anywhere either — close the tab and it's gone for good, which is exactly what you want for something like this.

Why does it save my length and character settings, then?

Only the settings (length, which character types are enabled) are remembered in your browser for convenience next time you visit — never the password itself. Generated passwords are never written to storage.

What does the strength estimate actually mean?

It's the password's entropy — how many attempts a brute-force search would need on average, expressed in bits. Each additional bit doubles the search space. The "time to crack" figure alongside it assumes 10 billion guesses per second, a reasonable stand-in for a fast offline attack — but the real number depends entirely on how whatever service stores this password hashes it. A properly slow hash (bcrypt, scrypt, Argon2) can make even a "weak" password take a very long time to guess; a fast, poorly-chosen hash can make a strong one crack faster than this estimate suggests. Treat it as a relative measure, not a guarantee.

Should I turn on every character type?

For most sites, yes — more character types means more possible combinations at the same length, which is strictly stronger. The exception is a service with unusual rules (no symbols, for instance) or somewhere you'll need to type the password by hand often, where turning off symbols or excluding similar-looking characters trades a little strength for a lot less frustration.

What's 'exclude similar characters' for?

It drops 0, O, 1, l, and I from the pool — the characters people most often misread or mistype from a screen or a handwritten note. Worth it for a password you'll be typing manually; not necessary for one going straight into a password manager.

Is a longer password always better than a more complex one?

Length wins more often than people expect. A 20-character password using only lowercase letters has more entropy than an 8-character one using every character type — 2620 is a vastly bigger number than 948. In practice, use both: a generator like this makes length free, so there's little reason to accept a short password even with a full character set turned on.

Related tools