Password Generator

Random passwords with length and character-set controls.

About Password Generator

A random password generator that builds passwords of 8 to 128 characters from the character sets you choose, with a strength meter, entirely in your browser.

How to use

  1. A 16-character password using all four character sets is generated when the page opens. Press Copy to take it, or New for another.
  2. Drag the Length slider from 8 to 128. A new password is generated each time the length changes.
  3. Untick any of Lowercase, Uppercase, Numbers or Symbols you cannot use. At least one set must stay ticked.
  4. Read the strength label (Weak, Medium, Strong, Very strong) under the password.

Options

  • Character sets: a–z, A–Z, 0–9 and the symbols !@#$%^&*()_+-=[]{}|;:,.<>?. Custom or excluded characters are not supported.
  • Every chosen set contributes at least one character, so a password with Numbers ticked always contains a digit.
  • Randomness comes from crypto.getRandomValues with rejection sampling, so every character in the pool is equally likely; Math.random is never used.
  • The strength meter shows entropy in bits, length × log2(pool size): under 40 is Weak, 40 to 59 Medium, 60 to 79 Strong, and 80 or more Very strong. It does not check dictionaries or breach lists.
  • There is no pronounceable or passphrase mode.

Example

16 characters, all four sets → x7Q!mR2#vL9pK@4w   (Very strong)
8 characters, digits only    → 48213907            (Weak)

Privacy

Passwords are generated in the page and shown only to you. No request is made, and nothing is stored or logged.

Frequently asked questions

How long should a password be?
At least 12 characters for everyday accounts and 16 or more for anything important; the default here is 16. With all four character sets each extra character multiplies the number of possibilities by 88, so length matters more than any single symbol.
Is it safe to use an online password generator?
Only if the password is generated locally. XUtil uses the browser’s cryptographic random number generator and makes no network request, so the password never leaves your device. Store it in a password manager rather than reusing it.
Why does the generator use crypto.getRandomValues instead of Math.random?
Math.random is a predictable pseudo-random generator that is not designed for security. crypto.getRandomValues draws from the operating system’s cryptographic source, so the output cannot be reproduced or guessed.