Secure Password Generator
A fresh password. A stronger starting point.
Cryptographically random, generated right here in your browser.
Your generated password
LOCAL ONLYHidden by default. Save a unique password in your password manager. This page cannot clear your clipboard.
The estimate counts allowed passwords after exclusions and all four requirements. It describes the search space, not guaranteed security or the entropy of your device's random source.
A 15-character password will be generated automatically when secure generation is available.
Salted hash · advanced
The JSON contains algorithm, digest, iterations, salt and hash; it excludes the plaintext password. Treat the verifier as sensitive. Use the original password to log in.
This is a portable PBKDF2 example, not a complete authentication system. For new production servers, prefer Argon2id with a maintained password-hashing library that manages salts.
Security, without impossible promises
How is the randomness generated?
The generator uses your browser's cryptographically secure Web Crypto random source. Rejection sampling chooses an unbiased random index from the exact set of valid passwords. Every allowed password of the selected length has the same probability. There is no weak random fallback, predictable seed, password history or account requirement.
Where do my password and salt go?
Generated values stay in this page's memory. The generator makes no network requests and writes no cookies, local storage or password log. Copying is an explicit action; your operating system and clipboard manager may retain copied values. Clearing removes values from this page, but cannot guarantee erasure of every browser-memory copy.
What is a “salted password”?
Salting belongs to password storage: a fresh random salt is combined with a password by a slow password-hashing function. This tool can generate an independent 128- or 256-bit salt and a 256-bit PBKDF2-SHA256 verifier with at least 600,000 iterations. Public salts protect against precomputed lookup attacks; they do not add secret entropy to a login password.
See the OWASP Password Storage Cheat Sheet for server-side guidance.
Can any generator guarantee absolute security?
No. A large search space helps resist guessing, but security also depends on the browser, device, website and password storage. Use longer unique passwords where accepted, keep them in a trusted password manager and enable multi-factor authentication or passkeys when available. This page refuses generation in an insecure browser context.
Shorter passwords are supported for compatibility, but a length of four only satisfies the four character requirements; it is not a secure recommendation.