Password Generator

Strong, random passwords with an honest strength meter — generated locally.

Processed locally – files never leave your device

Length: 16 characters

Your password(s)

Generated with crypto.getRandomValues — never Math.random. Nothing is uploaded or stored; copy the password into your password manager.

Next: try UUID v4 Generator — Generate random UUIDs in bulk.

Reusing passwords across sites is how one leak becomes many. This free password generator creates a fresh, random password for every account — you pick the length and which characters to include, and it shows the real entropy in bits so you know how strong the result actually is.

Passwords are built with your browser's cryptographic random generator, never Math.random, and they are never sent anywhere. Pair a new password with a fresh identifier from the UUID v4 Generator when you register test accounts, and keep the two jobs separate: identifiers identify, passwords protect. For quick sharing of a login-free link, the QR Code Generator can encode a URL.

How to use

Set the password length with the slider — 16 characters or more is a good default.
Tick the character sets you want: uppercase, lowercase, digits and symbols.
Click Generate password. The strength meter shows the entropy in bits.
Copy the password into your password manager. Generate again for a different one.

Why use Toolsvine

A password generator you cannot trust is worse than none at all — a weak or predictable generator hands attackers the keys. Toolsvine uses crypto.getRandomValues, the browser's cryptographic randomness, and shows honest entropy maths instead of a vague “strong” label. Everything runs locally, so your passwords are never uploaded or logged.

What password entropy really means

Entropy measures how many guesses an attacker would need, in bits. If a password is built from a character set of size N and has L characters, its entropy is L × log₂(N) bits. Each extra bit doubles the guessing work — so a 60-bit password is about a billion times harder to crack than a 30-bit one.

How much each character set adds

Character set	Symbols	Bits per character
Lowercase only	26	4.7
Lower + upper	52	5.7
Letters + digits	62	6.0
Letters + digits + symbols	89	6.5

A 16-character password from the full 89-symbol set has about 104 bits of entropy. A 12-character lowercase-only password has only about 56 bits. That gap is the whole game: length and variety together decide strength, and this tool shows the number instead of guessing at it.

Why crypto.getRandomValues, not Math.random

Math.random is designed for games and shuffling, not security — its output can be predicted if an attacker learns enough of it. crypto.getRandomValues draws from the operating system's cryptographic randomness, the same source used for encryption keys. This tool also draws each character with rejection sampling, so no character in the set is favoured over another.

Frequently asked questions

Are the passwords generated here really random?

Yes. They use crypto.getRandomValues, the browser's cryptographic random source — never Math.random, which is predictable. Each character is drawn with rejection sampling so every symbol in your chosen set is equally likely.

How long should my password be?

At least 16 characters for important accounts, using all four character sets — that gives roughly 104 bits of entropy. For a master password, 20 or more characters is better. Length matters more than clever substitutions.

What does the entropy number mean?

Entropy in bits measures guessing work: bits = length × log2(character-set size). Each extra bit doubles the work. A password with 80+ bits is far beyond any realistic brute-force attack.

Should I exclude ambiguous characters?

Only if you must read or type the password by hand — characters like 0, O, 1, l and I are easy to confuse. If you use a password manager, leave them in: every symbol you remove shrinks the character set and lowers entropy.

Is my password uploaded or stored anywhere?

No. Generation happens entirely in your browser. The password is never sent to a server, stored in a cookie, or logged — close the tab and it is gone.

Related tools

More in this category: Security & Privacy →