Password Generator

Create random passwords with the browser cryptography API, selectable character groups, an option to remove visually confusing characters, and a visible search-space estimate. The estimate describes combinations only; it is not a promise that an account is secure.

Browser-localFreeNo upload required

Tool workspace

Search space and strength estimate appear after generation.

Generated password

What this tool is for

Create random passwords with the browser cryptography API, selectable character groups, an option to remove visually confusing characters, and a visible search-space estimate. The estimate describes combinations only; it is not a promise that an account is secure.

How to use

Choose a length of at least 12 characters.
Enable at least two character groups and remove ambiguous characters when the password must be read aloud or typed manually.
Generate once, review the strength estimate, and store the value in a trusted password manager.

Example

A 20-character password using upper- and lowercase letters, numbers, and symbols has a much larger search space than an eight-character letters-only value.

FAQ

Is the strength label a security guarantee?

No. It is a mathematical estimate based on the configured character pool and assumes unbiased random generation.

Is the password uploaded?

No. Generation uses crypto.getRandomValues in the browser.

Reproducible examples

Known inputs and expected results

Run these examples in the workspace above and compare the result with the documented output.

Four character classes

Input: Length 16
Options: Enable uppercase, lowercase, digits, and symbols.
Action: Generate once and inspect the class coverage.
Expected output: A 16-character result containing at least one enabled character from each of the four classes.
Explanation: The exact password is intentionally unpredictable; the verifiable result is its length and enabled-class constraints.

Exclude ambiguous characters

Input: Length 20
Options: Enable letters and digits; exclude 0, O, I, l, and 1.
Action: Generate and scan the result for excluded characters.
Expected output: A 20-character password with no ambiguous characters and with the enabled classes represented.
Explanation: Exclusion narrows the source alphabet before secure random selection and shuffling.

Error or unsupported case

No enabled character class

Input: Length 16 with uppercase, lowercase, digits, and symbols all disabled
Expected error or limit: The generator rejects an empty source alphabet and produces no password.
Safer alternative: Enable every character class required by the receiving service's policy.

When not to use this tool

Recovering or storing passwords
Proving compliance with an organization's full password policy

Algorithm and assumptions

Generation requires Web Crypto; one character is chosen from every enabled class, remaining positions use rejection-sampled secure randomness, and the final array is securely shuffled.

Input and output

Input is a length and character policy. Output is one locally generated password plus pool size, combinations, and an approximate entropy label.

Supported formats and behavior

Lengths from 8 to 64
Uppercase, lowercase, numbers, and symbols
Optional removal of 0/O, 1/l/I and similar characters

Limits

A generated password cannot fix password reuse, phishing, or a compromised device
Some websites reject particular symbols or maximum lengths

Edge cases and common errors

Selecting no character group produces an error
Excluding ambiguous characters reduces the pool
Clipboard history can expose copied values

Release testing

Checks cover allowed character sets, requested length, empty-pool rejection, ambiguous-character removal, copy, and clear.

Privacy boundary

The input and result stay in this browser session. ZZP Box does not upload or store the values entered in this tool.

Related reviewed tools

Choose the next tool by the operation you need, then review that page's stated input and limits.