Password Generator

Strong Password Generator

Generate cryptographically secure passwords in your browser. Customize length, character types, and readability. Nothing is ever sent to a server.

Yes. We use crypto.getRandomValues — the Web Crypto API's cryptographically secure pseudo-random number generator (CSPRNG). It's suitable for passwords, tokens, and cryptographic keys.

No. Password generation happens entirely in your browser via JavaScript. No network request is made when you generate a password. You can verify this by opening your browser's Network tab.

—

Tip: press Space or R to regenerate.

16
416324864
Mode
Character types

Why Password Generator?

Cryptographically secure, customizable, and completely client-side.

Cryptographically secure

Uses the browser's crypto.getRandomValues — the same API banks and password managers use. No pseudo-random Math.random.

Customizable

Length 4–64, four character classes (upper, lower, digits, symbols), and three modes: all characters, easy to read, pronounceable.

Privacy by design

Passwords are generated entirely in your browser. Nothing is sent to any server, ever. No logging, no telemetry.

25 languages

Available in 25 languages with automatic browser detection. RTL support for Arabic, Persian and Urdu.

Bulk generation

Need passwords for a team or fresh API keys? Generate up to 10 at once, copy them all or download as a.txt file.

Strength meter

Real-time entropy-based strength estimation. See exactly how strong your password is before copying it.

How the password generator works

Cryptographic-grade randomness from your browser's hardware RNG.

  1. 1

    Choose length and character classes

    Pick the password length (we recommend 16+ for new accounts, 24+ for high-value services) and which character classes to include: lowercase, uppercase, digits, symbols. You can also enable an easy-to-read mode that excludes ambiguous characters like 0/O and 1/l/I, or a pronounceable mode for passphrases you can speak.

  2. 2

    Browser CSPRNG produces the bytes

    We call crypto.getRandomValues, the browser's built-in cryptographically-secure random number generator. On modern hardware this draws from the CPU's hardware entropy source (RDRAND on x86, ARM TRNG on Apple Silicon). The output is the same quality as /dev/urandom on Linux.

  3. 3

    Bytes mapped to your alphabet

    Random bytes are mapped to the chosen character set using rejection sampling — this avoids the modulo bias that naïve byte % alphabet.length would introduce. You get a uniform distribution across every character, every position.

  4. 4

    Strength meter and copy

    We compute the entropy (in bits) of the result and show it next to the password. Click to copy; the password lands on your clipboard via navigator.clipboard.writeText and is never sent anywhere over the network.

When to use which mode

Different security situations call for different password strategies.

New accounts on consumer services

16-character mixed-case + digits + symbols, stored in a password manager. That's ~95 bits of entropy — comfortable margin against any current cracking attack.

API keys and service tokens

32-character alphanumeric, copied straight into your .env file. The pattern most APIs accept; long enough that brute force is irrelevant.

Wi-Fi passwords (memorable)

Pronounceable mode produces things like karto-zelin-bauma — easy for a guest to type from a printed card, still 70+ bits of entropy.

Master passwords

Use the passphrase mode (4-6 random words) for things you have to type by hand without a manager — it's both stronger and easier to remember than a 12-character mixed-case password.

Why a generator's privacy matters

If a password generator's randomness comes from a server (or worse, is logged on its way back), every credential you produce is potentially compromised the moment it's created. iKit generates passwords using only your browser's hardware RNG — the bytes are never transmitted, never logged, never cached.

  • crypto.getRandomValues is hardware-backed and not deterministic.
  • Generated passwords never leave your browser; copy goes via the local clipboard.
  • No "saved passwords" history, no analytics on what you generated.

Related guides

Deep-dive tutorials and tool comparisons from the iKit blog.

Frequently Asked Questions

Are these passwords truly random?

Yes. We use crypto.getRandomValues — the Web Crypto API's cryptographically secure pseudo-random number generator (CSPRNG). It's suitable for passwords, tokens, and cryptographic keys.

Are my passwords sent anywhere?

No. Password generation happens entirely in your browser via JavaScript. No network request is made when you generate a password. You can verify this by opening your browser's Network tab.

What does each strength level mean?

The meter estimates entropy (bits of randomness): Weak <28 bits, Fair 28–40, Good 40–60, Strong 60–80, Very strong 80+. A 16-character password with all types is about 104 bits — Very strong.

Should I use pronounceable passwords?

Only if you need to speak or remember the password. Pronounceable passwords trade entropy for memorability — use a longer length (20+) to stay secure. For most use cases, random is better since you'll store it in a password manager anyway.

What's the recommended length?

16 characters with all four types is a strong default. For high-value accounts (email, banking, crypto) use 20+. Some systems cap at 16 or 20 — always check the site's requirements.