Password Generator
Generate strong random passwords with custom length, symbols, and character sets. Free browser-based — no passwords stored or transmitted.
How Password Generator Works
Generates passwords using crypto.getRandomValues() — the browser's cryptographic RNG, not Math.random(). Configure length (8–128), character sets (uppercase, lowercase, numbers, symbols), and ambiguous character exclusion.
Password Strength Recommendations
| Label | Meaning |
|---|---|
| 16+ chars, mixed set | NIST recommended minimum for general accounts |
| 20+ chars, mixed set | Strong — recommended for admin and email accounts |
| 12–15 chars, mixed set | Acceptable minimum for most sites |
| Below 12 chars | Weak — brute-forceable with modern hardware |
Frequently Asked Questions
Is this password generator secure?
Yes. Passwords are generated using crypto.getRandomValues() — the Web Crypto API's cryptographic random source. Nothing is transmitted to any server. The generated password is never stored. Close the browser tab and it's gone.
What makes a strong password?
Length matters most — a 20-character password with only lowercase is stronger than a 10-character password with all character types. NIST SP 800-63B (2023) recommends at least 15 characters and removing complexity rules in favour of length and uniqueness.
Should I include symbols?
Yes for maximum security, but verify the target site accepts them first. Some systems reject certain symbols (!, @, #) or have unexpected length limits. If a site rejects your generated password, use the 'exclude symbols' option.
Is my data stored?
No. Generated entirely in browser. Never transmitted.
Can I use this on mobile?
Yes.
About This Tool
Built by the Calcyo team and last updated June 2026. All calculations follow industry-standard methodology. No data leaves your browser — calculations run entirely client-side using JavaScript. If you spot an error in the formula or benchmark data, email us at support@calcyo.xyz.