Toolivaro

Free Password Generator

Generate strong passwords locally with cryptographically secure randomness — unbiased sampling, class guarantees, zero uploads.

The password generator creates strong passwords entirely in your browser. Choose a length from 8 to 128 characters, tick the character types you want — uppercase, lowercase, digits, symbols — and optionally exclude ambiguous characters such as 0, O, 1, l, and I that are easy to confuse when a password is read back or typed from a printout. Each password is drawn from crypto.getRandomValues, the same cryptographically secure source browsers use for WebAuthn and TLS key generation, and the sampling is rejection-based, so every character in the pool is exactly as likely as every other — no modulo bias, the subtle skew that plagues naive generators. At least one character from each selected type is guaranteed in the result, so a "digits" tick is never silently ignored; the rest of the pool fills the remaining positions and a full shuffle removes any pattern in where the guaranteed characters sit. The tool also reports the password's entropy in bits — length × log2(charset size), the exact figure for uniform random draws — so you can compare configurations honestly instead of trusting a colored strength meter. Lengths below 8 characters are rejected because NIST SP 800-63B sets 8 as the minimum for memorized secrets; the tool never generates a password it cannot defend. Nothing is uploaded, logged, or stored: a password is created in memory, copied, and gone. Use it when you are replacing a reused password, generating one per account, or producing a value for a vault that already exists.

Processed locally in your browser

8–128 characters. Every character multiplies the search space.

Removes characters people misread or mistype when retyping a password.

How is the result calculated?

A fresh value for a password vault

You are replacing a reused password for a new account. Set length to 16, leave uppercase, lowercase, and digits on, add symbols, and exclude ambiguous characters so the value survives being read aloud or retyped from a note. The generator returns something like K7#mQ2!vZ9pL4xR — 16 characters with an entropy of roughly 96 bits — and the same settings will produce a different password every time, so nothing about this example is a value you should reuse.

Input Value
length 16
uppercase true
lowercase true
digits true
symbols true
excludeAmbiguous true
Result K7#mQ2!vZ9pL4xR (sample — every generation differs)

What is the formula and its assumptions?

Unbiased random character selection

index = rejection-sample(crypto.getRandomValues) mod charsetSize

Symbol Meaning
crypto.getRandomValues the platform CSPRNG — the same source browsers use for TLS and WebAuthn key generation
rejection-sample discarding draws above a bound so every index 0…charsetSize−1 is exactly equally likely
charsetSize the number of characters in the union of the selected classes

A naive getRandomValues() % n biases low indices. Rejection sampling removes that bias, which is why the generator claims uniform randomness honestly.

Guaranteed class coverage

password = shuffle(one char per selected class + uniform pool fills)

Symbol Meaning
shuffle Fisher–Yates with the same unbiased sampler, removing position patterns
pool fills the remaining positions drawn uniformly from the full selected charset

Entropy

bits = length × log2(charsetSize)

Symbol Meaning
length the requested password length in characters
charsetSize the number of distinct characters the generator draws from

The exact information-theoretic entropy of a uniform random draw of length characters from a charset of that size — no fictional "strength score".

What are the most common mistakes?

  • Reusing a generated password across multiple accounts — a generator gives you strong values, but each account still needs its own.
  • Trusting a strength meter over the underlying math — this tool reports entropy in bits, which is the quantity that actually matters.
  • Shortening a password to the minimum just because it is allowed — every extra character multiplies the search space by the charset size.

What are the assumptions and limitations?

  • Length is limited to 8–128 characters, following NIST SP 800-63B guidance.
  • The generator does not include Unicode characters — the pool is the printable ASCII range.
  • Entropy assumes uniform random generation, which this tool provides; it says nothing about how you store or reuse the password afterwards.

Where do the numbers come from?

Last reviewed August 12, 2026 · Version 1.0.0 · Toolivaro does not guarantee external content.

Developer Hash Generator Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes locally with WebCrypto — hex and base64 output, nothing uploaded. Developer Base64 Encoder & Decoder Encode text or files to Base64 and decode back, with UTF-8 handling, validation, and size stats — fully local.

Frequently asked questions

Is the generation actually random, and how random?

Yes. Every draw comes from crypto.getRandomValues, the operating system CSPRNG that browsers use for TLS and WebAuthn key generation, and the sampler rejects biased residues so all characters are equally likely. The entropy figure on the page is the exact bits of randomness in the result — not a marketing score.

Why is the minimum length 8?

NIST SP 800-63B sets 8 characters as the minimum length for memorized secrets, and OWASP guidance agrees that length is the dominant factor in password strength. The generator refuses to produce weaker values, which is the honest behavior for a tool that reports entropy.

Are my passwords sent anywhere?

No. Generation happens entirely in your browser — the tool makes no network requests, uploads nothing, and stores nothing. A generated password exists in memory on your device until you copy it and close the page.

What does "exclude ambiguous characters" remove?

The characters people misread and mistype: 0, O, 1, l, I and the symbols |, ", ', and backtick. Excluding them slightly shrinks the charset (and thus entropy), but makes a printed or dictated password far less error-prone — the trade-off is yours to make, and the entropy figure reflects it honestly.

Why is there no strength meter?

Most strength meters are arbitrary scores with little relationship to how passwords are actually attacked. This tool shows the real quantity — entropy in bits — so you can compare configurations (length 16 with symbols versus length 20 without) on honest arithmetic.

Part of Password, hashing, and security tools

Found a mistake or have a correction? Report it — we review every correction.

Was this helpful?

Reviewed by the Toolivaro editorial team per our methodology Methodology · Editorial policy