Santekno/tools

Password Generator

Generate cryptographically strong passwords with configurable length and charsets. Secret never leaves your browser.

Processed in your browserUpdated · Jan 2026
Options
0 charslen×
Output
0 chars

How to use Password Generator

Paste your input on the left, choose the options you want, and the output appears instantly on the right. Everything runs in your browser — none of your data is sent to a server.

  • Paste or type your input in the INPUT panel
  • The output regenerates automatically as you type
  • Use Copy to put the result in your clipboard
  • Click Sample to load a working example

What is Password Generator?

Password Generator uses `crypto.getRandomValues` (CSPRNG, not `Math.random`) plus rejection sampling to avoid modulo bias. Configurable length (1–256, default 20), charset toggles for lower/upper/digits/symbols, and an "exclude ambiguous" mode that strips `0OoIl1`. Bulk mode generates up to 100 unique passwords in one click. Generated passwords are NOT persisted — they live only in browser memory and disappear when you close the tab. Pairs with the Password Strength Meter for instant entropy feedback. This tool is part of santekno's developer toolbox — a curated collection of utilities built for engineers who care about speed, privacy, and simplicity.

Common use cases

  • Debugging API payloads and integration issues
  • Inspecting tokens, hashes, or encoded strings during development
  • Generating fixtures and sample data for tests
  • Sharing readable output with teammates in code reviews

FAQ

Strength Meter EVALUATES a password you already have. Generator CREATES a new one. Use Generator → paste into Meter to verify the score.

Browser `crypto.getRandomValues` — a cryptographically secure pseudorandom number generator (CSPRNG). NEVER `Math.random` (which is predictable).

Removes 0OoIl1 — characters that look alike in many fonts. Useful when the password will be read aloud or copied by hand.

No. It lives only in volatile browser state. Refresh / close tab → gone. Nothing is written to localStorage, sessionStorage, IndexedDB, or cookies.

256 characters. Beyond that the value of additional length is purely theoretical — modern password hashes (bcrypt, argon2) already cap input length internally.