Secure Password Generator

Choose a password length from 4 through 256 characters.

Select lowercase letters, uppercase letters, numbers, symbols, or any supported combination.

Enable ambiguous-character filtering when the password may need to be read or typed manually.

Choose whether to generate 1, 5, or 10 independent passwords, then select Generate.

Copy the chosen result into a trusted password manager and assign it to only one account.

Every returned character belongs to one of the selected character sets.

Every returned password contains at least one character from each selected set.

The generator does not satisfy that condition by inserting predictable characters into fixed positions.

Instead, it generates a uniformly random candidate from the complete pool and rejects the candidate when one or more selected sets are missing.

The full pool contains 86 distinct ASCII characters: 26 lowercase letters, 26 uppercase letters, 10 digits, and 24 symbols.

With ambiguity filtering enabled, the full four-set pool contains 80 characters.

The sets are disjoint, so each character belongs to exactly one enabled category.

The symbol collection is intentionally fixed. A service with a narrower symbol policy may require disabling symbols or manually checking compatibility.

The generator obtains unsigned 32-bit values from crypto.getRandomValues rather than Math.random.

Web Crypto is designed to provide cryptographically strong random values using the browser and operating system's random-number facilities.

If secure browser randomness is unavailable, generation stops with an error instead of silently falling back to a weaker source.

A random 32-bit value cannot always be divided evenly across a character pool.

Using value modulo pool size without correction can therefore make some character indexes slightly more likely than others.

The generator calculates the largest evenly divisible portion of the 32-bit range and discards values outside it.

The accepted values then map evenly to every character in the pool.

A common password-generation shortcut inserts one character from each required set and then shuffles the result.

That approach guarantees coverage but does not generally make every valid final password equally likely.

This implementation instead samples a complete candidate uniformly from the combined pool.

Candidates missing a selected set are rejected. Conditioning a uniform candidate process on the coverage rule leaves every accepted password equally likely.

Search-space bits are the base-2 logarithm of the number of different passwords this exact configuration can return.

A result of 128 bits means that the valid output set contains approximately 2¹²⁸ possible passwords.

Because every valid output is equally likely, this is a meaningful description of the generator's random output space.

It is still not a promise of cracking time. Real attacks depend on password reuse, breaches, service rate limits, password hashing, phishing, malware, and other controls.

For unrestricted independent selection from a pool of C characters, a length-L password has Cᴸ possibilities and L × log₂(C) bits.

This generator adds the condition that every selected character set must appear at least once.

That condition removes candidates that are composed entirely from only some of the enabled sets.

The implementation therefore counts valid passwords with inclusion–exclusion before converting the count to bits.

Increasing length multiplies the output space once for every additional position.

Enabling another set can also enlarge the pool, but a few additional random characters often contribute more search space than a small pool change.

Choose the longest password the destination service reliably supports and store it in a password manager rather than shortening it for memorability.

The displayed bits allow configurations to be compared, but they should not be treated as a universal security score.

Current NIST verifier guidance says services should not impose mandatory character-composition rules on user-chosen passwords.

That guidance addresses password-policy design and predictable human behaviour.

This tool generates machine-random passwords, so the set controls are useful for matching a destination's accepted characters and ensuring requested categories appear.

Selecting every set is not automatically better than choosing a sufficiently long password from a smaller accepted pool.

Ambiguous-character filtering removes I, l, 1, O, 0, and o.

This can reduce transcription mistakes when passwords must be read from paper, spoken, or typed on another device.

Filtering reduces the full pool from 86 to 80 characters, so it slightly reduces the mathematical search space at the same length.

The reduction is usually modest compared with the benefit of adding one or more random characters.

A batch of 5 or 10 creates independent passwords using a new sequence of cryptographic selections for every result.

The passwords are not mutations, prefixes, or numbered versions of one another.

Batch generation is useful when preparing several separate test accounts, devices, vault entries, or temporary credentials.

Each result should still be assigned to only one account or purpose.

Machine-generated passwords are intentionally difficult to remember.

A password manager can store a different long password for each service and fill it without requiring the user to memorize or repeatedly type it.

Current NIST guidance requires verifiers to allow password managers and autofill and recommends permitting paste when autofill is unavailable.

Protect the password manager itself with strong authentication, recovery controls, software updates, and an appropriate backup strategy.

Password reuse allows a credential exposed by one service to be tested against unrelated services.

Generating a new independent value for every account limits the effect of one password disclosure.

Do not create a reusable base password and append the website name, year, or a predictable number.

Do not use one generated batch as a visible pattern for related accounts.

A long random password can resist guessing while still being stolen through a fraudulent sign-in page.

It can also be captured by malware, browser compromise, remote-access software, or an unsafe recovery process.

Use suitable multifactor authentication where available, especially for email, financial, administrative, developer, and password-manager accounts.

Authentication security depends on the complete account system rather than the generated string alone.

Copying makes password entry easier but moves the value into the operating-system clipboard.

Clipboard history, synchronization, remote-desktop software, browser extensions, or other local applications may retain or observe copied content.

Paste the password promptly into its intended destination and clear clipboard history when the device or environment requires it.

Avoid generating credentials while screen sharing, recording, streaming, or using an untrusted device.

Some sites impose undocumented length limits or reject certain symbols.

First check the site's stated password requirements and reduce only the unsupported setting.

Prefer disabling an incompatible symbol set or shortening within the documented limit rather than repeatedly modifying a generated password by hand.

Never assume that silent truncation by a service preserves the displayed search space.

The generator does not send passwords to a breached-password service or compare them with a common-password list.

It does not test password-manager security, account recovery, multifactor settings, destination hashing, rate limiting, or phishing resistance.

It does not determine whether a generated value is acceptable under a particular organization's policy.

Its purpose is narrow: generate random strings accurately and explain their mathematical output space.

Password generation and search-space calculations run entirely in the browser.

The implementation does not transmit generated passwords to Olivez or place them into a shareable URL.

Passwords are held in the page's temporary runtime state until settings change, Reset is selected, or the page is closed or replaced.

Selecting Copy deliberately sends the chosen text to the browser and operating-system clipboard.