Password Generator

About this tool

Password Generator on UtilityKit creates cryptographically strong random passwords entirely in your browser using the Web Crypto API's window.crypto.getRandomValues, with rejection sampling so every character in the pool is equally likely. Choose a length from 4 to 64 characters with the slider, toggle uppercase, lowercase, numbers and symbols, and optionally drop the look-alike characters 0, O, l and 1. A strength bar rates each password from Weak to Very strong based on its length and the character types it contains, and a Generate 5 button lists five candidates at once. Generated passwords are never transmitted to any server, never logged, and vanish when you close the tab. The tool is designed for situations where you need a strong, unique password immediately — creating a new account, rotating a shared service credential, or generating a Wi-Fi passphrase — without exposing the value to a server.

Why use it

• Cryptographic Entropy: Uses window.crypto.getRandomValues — OS-level entropy — not Math.random(). The difference matters: Math.random() is predictable; the Web Crypto API is not.

• Zero Transmission: Generated passwords are never sent to any server. The entire generation process runs in your browser and the result exists only in your clipboard and on screen.

• Custom Charset Control: Enable or disable uppercase, lowercase, digits, and symbols independently to match the requirements of a password policy without manual character-by-character editing.

• Ambiguous Character Exclusion: One checkbox removes 0, O, l and 1 to prevent transcription errors when a password must be read from a screen or printed page.

• Strength Feedback: A colour-coded bar and label show at a glance whether the current length and character mix rate as Weak, Fair, Good, Strong or Very strong.

• Instant and No Install: No extension, no app, no account. Works in any browser on any device — generate a password from a shared computer or on mobile in seconds.

How to use

1. Drag the Length slider to set a length between 4 and 64 characters (16 by default). Common recommendations: 16+ characters for most accounts and 24+ for admin credentials.
2. Tick the character types you need: Uppercase, Lowercase, Numbers and Symbols. At least one must be selected; the password regenerates as soon as you change an option.
3. Optionally tick 'No ambiguous (0,O,l,1)' to remove those look-alike characters — useful for passwords that will be read aloud or typed manually from a screen.
4. Click Regenerate for a fresh password. The tool uses window.crypto.getRandomValues — not Math.random() — so every draw is cryptographically unpredictable.
5. Check the strength bar under the password, which rates it from Weak to Very strong based on length and the character types present.
6. Click Copy (or click the password itself) to copy it, then paste it into your target field or password manager. Click Generate 5 if you want several candidates to choose from.

When it helps

• When creating a new account on any service and you want a unique, strong password that is not reused from another site.
• When rotating a compromised or weak password for a critical service — database root, cloud admin console, or API key — and you need something strong immediately.
• When generating a Wi-Fi passphrase for a new network and you want something long enough to be secure but can exclude ambiguous characters for easier manual entry on devices.
• When a system restricts which character types are allowed (for example letters and digits only) and you want a random password drawn only from those types.
• When you need a temporary password to hand to a new team member before they set their own, and you want it strong enough to be safe during the handoff window.
• When you need a handful of random credentials for test accounts and want five candidates generated in one click.

Examples

Tips

• Generate passwords of at least 20 characters for any account you consider critical — the marginal length cost is zero, and longer passwords are exponentially harder to brute-force.
• Enable all four character sets (upper, lower, digits, symbols) by default and only disable symbols when the target site explicitly rejects them — switching to a longer length to compensate.
• After generating, copy immediately and paste into your password manager's notes field before pasting into the target site — reduces the risk of losing the password if the site rejects it for some reason.
• Use the ambiguous-character exclusion only for passwords that will be read aloud or typed manually; for passwords pasted directly from a manager, keep all characters enabled for maximum entropy.
• If you need several passwords (e.g. for a few test accounts), click Generate 5 — each one draws new entropy independently, and Copy grabs the whole list.

Frequently Asked Questions

Glossary

CSPRNG

Cryptographically Secure Pseudorandom Number Generator — an algorithm that produces random numbers indistinguishable from true randomness for cryptographic purposes. window.crypto.getRandomValues is a browser CSPRNG backed by OS entropy.

Entropy (bits)

A measure of unpredictability expressed as log2(possible combinations). A password with 70 bits of entropy has 2^70 possible values — the larger the number, the more resistant the password is to brute-force attacks.

Character Set

The pool of characters a password is drawn from. Typical sets are uppercase (A–Z, 26 chars), lowercase (a–z, 26 chars), digits (0–9, 10 chars), and symbols (!@#$%^&* etc., ~32 common chars). Larger pools increase entropy per character.

Brute-Force Attack

A password-cracking method that tries every possible combination of characters systematically. The time required grows exponentially with password length and charset size, which is why entropy is the primary measure of password strength.

Ambiguous Characters

Characters that look visually similar in many fonts and can be misread when transcribed manually: 0 (zero) and O (capital O), 1 (one) and l (lowercase L) and I (capital i). Excluding them reduces transcription errors without meaningful entropy loss for long passwords.

NIST SP 800-63B

A US National Institute of Standards and Technology publication that provides guidelines for digital identity and password policy. Key recommendations include favouring length over complexity rules and not requiring periodic rotation without evidence of compromise.