About — Password Generator

The main generator makes a random password from the character groups you select: uppercase letters (ABC), lowercase letters (abc), numbers (123) and special characters (#$&). Pick a length with the slider (4–48) or type any whole number into the field, press the reload button for a new password, and the copy button puts it on your clipboard.

The three exclude filters remove characters that cause trouble:

configuration files.

that make passwords awkward or dangerous to paste into terminals, SQL or commands.

keyboard layouts.

*String characters* — quotes that clash with quoted strings in code and
*Command characters* — quotes, semicolons, pipes and shell metacharacters
*Hard to press* — characters that need AltGr or are missing on many

Presets fill in sensible combinations in one click: *RSA pass* (48 characters, no quote characters), *Bank PIN* (4 digits), *Safe web password* (32 characters with every exclude filter on) and *Very secure* (48 characters, nothing excluded).

The other generators page has tools for password-adjacent strings:

(like delta-sunny-giraffe-mango-windy), with optional capitalisation and a two-digit number. Easier to memorise and type, still strong.

(time-ordered), per RFC 9562.

alphabet (no o/l/i), made for URL shorteners and similar services.

*Passphrase* — five common words joined with dashes
*UUID* — standard identifiers, version 4 (fully random) or version 7
*Short strings* — four- and five-character strings from an unambiguous

Randomness

Every generator on this site draws randomness exclusively from the browser's Web Crypto API (crypto.getRandomValues()), a cryptographically secure pseudo-random number generator seeded by the operating system. Math.random() is never used anywhere — it is not suitable for secrets.

Random integers are made uniform by *rejection sampling*: values above the largest multiple of the target range are discarded, so no remainder bias exists (a naive modulo would favour smaller numbers).

The password generator

Your selected character groups are unioned into one alphabet, then the characters named by your exclude filters are removed. The generator then:

1. picks one character from each character group that still has survivors after exclusion, so every selected group is always represented; 2. fills the rest of the password from the combined alphabet; 3. shuffles all positions with a Fisher–Yates shuffle so the guaranteed characters are not predictable by position.

Because of step 1, a selected group can never be absent from the result — that guarantee is checked by the automated test suite. With all groups and no exclusions, the alphabet has 88 characters; a 16-character password carries about 103 bits of entropy.

The passphrase generator

Words come from the EFF large word list (7776 words), vendored into the site — the four hyphenated entries are removed so that - stays an unambiguous separator. Each uniformly chosen word carries log2(7772) ≈ 12.9 bits, so the default five words give about 64.6 bits — comparable to a random 9–10 character password, but far easier to remember and type. The optional two-digit number adds ~6.6 bits.

The UUID generator

Both versions follow RFC 9562. Version 4 is 122 random bits. Version 7 prefixes 48 bits of Unix-millisecond timestamp (sortable by creation time) with 74 random bits. Version and variant nibbles are set exactly as the RFC requires; the timestamp portion is what makes v7 IDs sort naturally.

The short-string generators

Strings of 4 or 5 characters from a 31-character alphabet (lowercase letters and digits, minus o, l, i to avoid visual confusion with 0 and 1). A 5-character string carries about 24.5 bits — plenty for a URL-shortener slug whose real protection is that nobody guesses which slug belongs to whom.

What this site does not do

There is no backend and no network call after the page loads. Passwords are generated in your browser's memory and are never transmitted, logged, or stored. The site has no analytics, no cookies, and works offline once loaded. The complete test suite (75 tests) runs on every change and verifies the membership guarantees described above.

This site is a quick side project, made because I wanted my own password generator: always available, exactly the way I like it, and something I can confidently share and recommend when people ask me how I generate my passwords — without worrying that someone else remembered the tool I used or saved anything about me.

It runs entirely in your browser, collects nothing, and sends nothing anywhere. The source is open under the MIT licence below, so you can read exactly what it does — or run your own copy.

I hold no liability for anything you do with these passwords or this site. Choose long passwords, keep them in a password manager, and use two-factor authentication where it matters.

MIT Licence

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.