Password & Token Generator
Generates cryptographically random passwords and alphanumeric tokens using crypto.getRandomValues with entropy scoring.
Private by architecture:
All processing is 100% client-side memory. Your data never leaves this browser tab.
Parameters
Character categories
Generated Credential
-
About This Tool
Generates random passwords and alphanumeric tokens entirely in your browser using crypto.getRandomValues, the Web Crypto API cryptographic pseudo-random number generator, combined with rejection sampling to eliminate modulo bias. Math.random() is never used.
Password mode allows customizing character categories (uppercase, lowercase, numbers, symbols) and dropping visually ambiguous characters (0, O, 1, l, I, |). Token mode produces pure alphanumeric strings without punctuation for API keys and database credentials.
Key Features
- Web Crypto CSPRNG: Every character originates from crypto.getRandomValues with rejection sampling.
- Configurable length: Adjustable slider from 4 to 128 characters with real-time numeric readout.
- Four character categories: Toggle uppercase, lowercase, numbers, and symbols with minimum-one enforcement.
- Ambiguous character filter: Excludes characters like 0, O, 1, l, I, and pipe that cause reading confusion.
- Token mode: Produces clean alphanumeric strings suitable for API tokens and environment secrets.
- Entropy strength meter: Computes exact Shannon entropy in bits and rates password resistance.
Frequently Asked Questions
Why does this tool use crypto.getRandomValues instead of Math.random()?
Math.random() is a deterministic PRNG whose internal state can be inferred from observed outputs. crypto.getRandomValues() queries the operating system entropy pool, providing cryptographic security against prediction.
How is the entropy strength score calculated?
Entropy is computed as length * log2(charsetSize) bits. Passwords with fewer than 40 bits are rated Weak, 40 to 60 Fair, 60 to 80 Strong, and over 80 bits Very Strong.
What characters are removed when excluding ambiguous characters?
Zero (0), uppercase O, one (1), lowercase l, uppercase I, and pipe (|) are removed to prevent mistyping when reading credentials from screen.
What is the practical difference between Password mode and Token mode?
Password mode allows full special characters and symbols for user accounts. Token mode produces clean alphanumeric strings without punctuation for software API keys, webhooks, and database secrets.
Are generated passwords or tokens stored or sent across the network?
No. All generation and entropy math execute strictly in local browser memory. Zero credentials are ever logged or transmitted.
