Estimated entropy: ~129 bits
Free Online Password & Key Generator
Generate a secure, random password, API key, or secret token with full control over length and character types — generated locally using your browser's cryptographically secure random number generator, never sent anywhere. It helps developers create unique credentials, API keys, and test secrets instead of reusing predictable passwords.
How to generate a secure password or key
Set the length using the slider (8 to 128 characters), choose which character types to include, and click Generate. Every character is chosen using crypto.getRandomValues(), the browser's cryptographically secure random number source — the same underlying API used for security-critical operations, not the predictable Math.random() function.
Passwords vs. API keys vs. secret tokens
A user-facing password needs to balance strength with the practical reality that a person might need to type it — 16-20 characters with a mix of character types is a solid default. An API key or secret token used only by a program has no such constraint, so longer is generally better: 32-64 characters gives a comfortable security margin for something that will never be memorized or typed by hand.
Understanding entropy
Entropy, measured in bits, describes how many possible values a generated password could take — each additional bit doubles the number of possibilities an attacker would need to try. Both the character pool size (which types are enabled) and the length contribute to entropy: turning off a character type reduces the pool, so consider increasing the length to compensate if a particular service restricts which characters you can use.
How to use Password Generator for related tasks
Choose length and character classes, generate a value, and store it in a trusted password manager rather than in source control.
Related tools: Password Strength Checker, Hash Generator.
Frequently asked questions
Are the passwords generated here actually secure?
Yes — generation uses crypto.getRandomValues, the same cryptographically secure random number source browsers use for security-critical operations, not Math.random(). Nothing is sent to a server, and nothing generated is logged or stored anywhere.
What length should I use for a password vs. an API key?
For a user-facing password, 16-20 characters with all character types enabled is a reasonable strong default. For an API key or secret token that a program will store and use (never typed by a human), 32-64 characters is common practice, since length matters more than memorability there.
What does the entropy (bits) number mean?
It's a measure of how many possible values the password could be, expressed as a power of 2 — higher is better. As a rough guide, 60+ bits is reasonable for most personal use, and 80+ bits is common practice for high-value accounts or secrets.
Should I avoid symbols if a website doesn't accept them?
Yes — turn off the Symbols toggle if a service rejects special characters. Removing a character type reduces the entropy for a given length somewhat, so consider increasing the length to compensate.
How long should a generated password be?
Prefer a long unique value appropriate to the service; length and uniqueness matter more than forcing a short mix of symbols.