Generate a strong, random password in your browser using the cryptographically secure crypto.getRandomValues, with rejection sampling so every character is uniform (no modulo bias). Choose the length and which character classes to include; the generator guarantees at least one character from each class you enable. The password is created entirely on your device — never transmitted, never stored. Free, no signup, no ads on the tool.
Password strength comes from entropy — the number of possibilities an attacker would have to work through — and entropy comes from length far more than from complexity rules. A long passphrase drawn from a large character set beats a short string with a symbol bolted on, which is why modern guidance from NIST dropped mandatory complexity requirements in favour of length. Every password here is generated with your browser's cryptographic random source and never transmitted anywhere.
Set the length
Drag the slider to your desired length — longer is stronger. 16–24 characters is a good default.
Pick character types
Toggle lowercase, uppercase, numbers, and symbols. The password regenerates instantly with each change.
Copy your password
Hit copy. The password was generated locally and is never sent anywhere.
Length beats complexity
Adding one character multiplies the search space; adding one symbol to a short password barely moves it. If you have to choose, choose longer.
Don't reuse, even strong ones
A strong password reused across sites is only as safe as the least careful site holding it. This is the argument for a password manager: it makes every password both strong and unique without you memorising any of them.
Generated locally, and not stored
The password is produced in this tab with crypto.getRandomValues and exists only in the page until you copy it. There is no history, no sync, and no upload endpoint — which also means refreshing the page loses it.
How random are the passwords?
They use crypto.getRandomValues — the browser's cryptographically secure RNG — with rejection sampling to avoid modulo bias, so every character is uniformly random.
Is the password sent to a server?
Never. It's generated in your browser and isn't transmitted or stored anywhere. You can disconnect from the internet and it still works.
Does it avoid ambiguous characters?
Yes. The character sets exclude easily-confused glyphs like 0/O and 1/l/I so the password is easier to read and type correctly.
Will it include at least one of each type I pick?
Yes — the generator guarantees at least one character from every class you enable, then fills the rest randomly and shuffles.
What length should I use?
For most accounts, 16–24 characters with all classes enabled is strong. For high-value accounts, go longer — the slider supports up to 64.
Are these passwords truly random?
They're drawn from crypto.getRandomValues, the browser's cryptographically secure generator — the same source used for key material. That's meaningfully different from Math.random(), whose output is predictable given enough samples.
Should I include symbols?
It helps, but less than people expect. Some systems still reject certain symbols, so a longer alphanumeric password is often the more practical choice than a shorter one padded with punctuation.
Every GhostDev tool runs entirely in your browser. Your file is never uploaded — there's no upload endpoint to send it to.