Password Generator — Secure Random Passwords Instantly

Password Generator is a free, browser-based tool that creates cryptographically secure passwords using the Web Crypto API. Adjust length, select character sets, generate up to 50 passwords at once, and check strength with an entropy-based indicator — all without a single server request.

The Problem

Most online password generators fall into two categories: ones that use Math.random() (not cryptographically secure) and ones that send your configuration to a server (which defeats the purpose of a privacy tool). The few that are secure and private are often hard to use — buried in settings menus or hidden behind account walls.

Developers and IT professionals need to generate passwords constantly: seeding databases, creating test credentials, setting up service accounts, sharing temporary access. They need a tool that's:

• Instantly available — one URL, no login
• Truly random — cryptographic quality, not pseudo-random
• Flexible — control length and character sets precisely
• Private — zero server requests, zero logging

How It Works

Cryptographically Secure Randomness

All password generation uses window.crypto.getRandomValues() — the Web Crypto API built into every modern browser. This is the same source of randomness browsers use for TLS key material. No Math.random() is used anywhere in the generation path.

function secureRandom(max: number): number {
  const array = new Uint32Array(1);
  window.crypto.getRandomValues(array);
  return array[0] % max;
}

Guaranteed Character Set Inclusion

When you select multiple character sets, the tool guarantees at least one character from each set appears in the password. This prevents a password from accidentally omitting a required character type (a common failure in naive generators that just randomly select from a combined charset):

1. Draw one character from each selected set
2. Fill remaining positions from the combined charset
3. Shuffle the combined array using a Fisher-Yates shuffle — also powered by getRandomValues()

The result: guaranteed distribution requirements, unpredictable ordering.

Entropy-Based Strength Meter

The strength indicator calculates bits of entropy using the formula:

bits = length × log₂(pool_size)

Where pool_size is the size of the character pool based on selected sets (26 + 26 + 10 + N symbols). This gives a mathematically grounded assessment rather than heuristic pattern matching:

• < 8 chars → Too Short
• < 40 bits → Weak
• < 60 bits → Fair
• < 80 bits → Strong
• ≥ 80 bits → Very Strong

Bulk Generation

The count slider (1–50) generates that many passwords in one click. Each uses an independent call to getRandomValues(). The output list shows all passwords with per-row copy buttons and a "Copy All" option that joins them with newlines — useful for piping into scripts or seeding test fixtures.

Key Features

• Cryptographically secure — window.crypto.getRandomValues(), no Math.random()
• Length slider — 4 to 128 characters, with numeric input for precision
• Character sets — uppercase, lowercase, digits, symbols — toggle each independently
• Guaranteed inclusion — at least one character from each enabled set
• Bulk generation — 1–50 passwords per click
• Strength meter — entropy-based score with bit count
• Copy to clipboard — per-password and "Copy All" for bulk
• 100% client-side — zero network requests, zero logging
• No account required — open the URL and start generating

Technical Implementation

Core Technologies

• Next.js 16 with App Router and server components for metadata
• TypeScript in strict mode — no any types
• Tailwind CSS v4 with OKLCH color tokens and brand CSS variables
• shadcn/ui components (Card, Button, Badge)
• framer-motion for entrance animations and the strength bar transition
• Web Crypto API — no external cryptography dependencies
• Sonner for toast notifications on copy

Architecture

The tool is a single "use client" component with no external API calls. State lives in React useState hooks:

• length — slider and numeric input, clamped to [4, 128]
• useUpper, useLower, useNumbers, useSymbols — character set toggles
• count — bulk count slider [1, 50]
• passwords — array of generated strings, cleared on regenerate

The generate() function is wrapped in useCallback to avoid unnecessary re-creation. The Fisher-Yates shuffle in the generation function uses secureRandom() for every swap index, not a seeded PRNG.

Character Set Collision Prevention

A subtle bug in many password generators: if you select only one character set, disabling it should be prevented (you'd have no charset to draw from). The CheckboxOption component accepts a disabled prop that is true when the current checkbox is the only one selected — preventing the user from locking themselves into an empty charset.

Use Cases

Database Seeding and Test Credentials

When seeding a database with test users, generate 20–50 passwords at once with the bulk mode. Copy all with one click and pipe them into a seed script or CSV. Each password is independent and cryptographically secure — appropriate for test environments that may run against production-adjacent infrastructure.

Service Account Setup

IT and DevOps teams creating service accounts, API keys as passwords, or temporary access credentials need passwords that meet complexity requirements. The character set toggles let you match exactly what the target system accepts (some systems reject certain symbols).

Password Manager Migration

When migrating to a password manager, you need strong, unique passwords for every account. Use the generator to create 16–32 character passwords for high-value accounts, with all character sets enabled.

Security Demos and Training

Security teams demonstrating password best practices can use the entropy display to show the audience why length matters more than complexity patterns. A 20-character lowercase-only password has more entropy than an 8-character "complex" password.

Development and CI Secrets

Generating secrets for environment variables, JWT signing keys, or webhook tokens. The 64–128 character range with all character sets produces values appropriate for most secret material.

Why Password Generator?

vs. openssl rand / pwgen

• No CLI required — share a URL instead of a terminal command
• Visual feedback — see strength and character set selection in real time
• Bulk output — structured output ready to copy, not a terminal string to manipulate

vs. Other Online Generators

• Web Crypto API — not Math.random()
• Zero server calls — verified in DevTools: no network requests
• No account or ads — open the URL, generate, leave

vs. Password Manager Built-in Generators

• Accessible without the manager — useful for sharing with non-technical team members
• Bulk generation — password managers generate one at a time
• Copyable list — paste directly into scripts or CSVs

Results

Password Generator provides immediate access to cryptographically secure passwords:

• Secure by default — Web Crypto API, not Math.random()
• No friction — one URL, no login, no install
• Flexible enough for developer workflows (bulk, character sets, copy all)
• Private by design — verified zero server requests

Try it now: password-generator.tools.jagodana.com