Generate random passwords in your browser with Web Crypto. Set the length and character classes or use your own alphabet, and make up to 1,000 at once.
Runs in your browser — your input is processed on this device and never uploaded.
Password length, 4 through 4096. Default 20.
How many passwords to return, 1 through 1000, one per line. Default 1.
If set, sample only from these unique characters, up to 1024. Cannot combine with class toggles, exclude ambiguous, or require each.
Results appear here.
A random password generator picks characters at random from an alphabet you choose. It does not remember accounts and does not hash anything. You copy the result into a password manager or a signup form.
This tool generates passwords in your browser, with randomness from Web Crypto (getRandomValues). Nothing you set or generate is stored.
The result shows the passwords, how many were made, and the alphabet size, so you can work out the strength yourself.
People reuse short passwords, and those passwords end up in breach lists. A long random string avoids both the reuse and the pattern that only looks random, such as a keyboard walk.
Strength comes from length and alphabet size. With every class on, the alphabet has 87 characters, so the default 20 characters give about 129 bits of randomness. Brute force will not get through that.
A website's generate button may quietly drop symbols, cap the length at 16, or use Math.random. You cannot check that from the page. This one states the alphabet, the length and the source of randomness.
Password managers such as Bitwarden and 1Password generate and store passwords in one step. Use one of those for your own accounts, because a password you cannot find again is not much use.
Argon2id Hash Generator on ToolkitBay hashes a password you already have, for storing a verifier rather than making a new secret. TOTP 2FA Code Generator makes the one-time codes for an existing two-factor secret.
Do not use this page as a password store, and do not read more into the result than the alphabet size and length support.
The symbol set is fixed, so two runs with the same settings use the same alphabet. If a site rejects some symbols, type the letters, digits and symbols it does accept into custom alphabet.
Exclude ambiguous helps when someone will read the password off a screen or over the phone. It shrinks the alphabet a little, which is the trade.
Characters are drawn uniformly from the unique characters you allow. Repeats in a custom alphabet are ignored, so aabbcc is an alphabet of three.
Generation runs in your browser. The passwords are not sent to ToolkitBay's servers.
Find similar tools by category or tag.