Skip to content
BeeTools— Fast. Private. Free.

Password Generator

Runs in your browser

Generate strong random passwords using your browser’s cryptographic random source. Never transmitted, never stored.

Security Tools

Your password

90 possible characters per position

Strength: Very weak0 bits of entropy

Brute-forcing this would take instantly at 100 billion guesses per second.

Settings

Between 4 and 128. Sixteen or more is a sensible default.

Generated with crypto.getRandomValues(), your browser’s cryptographically secure random source. Passwords are created on your device, never transmitted, and never stored — not in a log, not in local storage, and not in your browser history.

Your data never leaves your device

This tool runs entirely in your browser. Nothing you enter is uploaded, stored or logged by BeeTools.

How to use the password generator

  1. Set the length

    Drag the slider. Sixteen characters is a good default for an account; twenty or more if the password protects something valuable and you are storing it in a manager anyway.

  2. Choose character types

    Leave all four on unless a site rejects symbols. Each type you disable shrinks the search space, which the entropy figure reflects immediately.

  3. Exclude look-alikes if needed

    Turn this on for a Wi-Fi password or anything you will read off a screen. It slightly reduces entropy, which longer length more than compensates for.

  4. Copy it straight into your password manager

    Use Copy and paste it directly where it belongs. Generate a fresh one for every account rather than reusing.

Features

  • Cryptographically secure

    Uses crypto.getRandomValues(), not Math.random(), whose output is predictable.

  • Unbiased character selection

    Rejection sampling ensures every character is equally likely, so the entropy figure is honest.

  • 4 to 128 characters

    Choose exactly the length a site allows, with a live strength readout as you adjust it.

  • Exclude look-alikes

    Remove I, l, 1, O, 0, S, 5, B and 8 for passwords you will read aloud or type by hand.

  • Satisfies strict rules

    Guarantee at least one character from each enabled set, then shuffle so position leaks nothing.

  • Never leaves your device

    Generated locally and not stored anywhere — no logs, no local storage, no history.

About this tool

A password is only as good as the randomness behind it. This generator draws every character from crypto.getRandomValues(), the cryptographically secure random source built into your browser, and it uses rejection sampling so that each character in the alphabet is exactly as likely as every other.

That second detail is easy to get wrong and worth being explicit about. The obvious way to pick a random character is to take a random number modulo the alphabet size — but unless the alphabet size divides evenly into the range, the earlier characters come up slightly more often. This tool discards values that would introduce that skew, so the distribution is genuinely uniform and the entropy figure shown is the real one.

You control length and which character types to include, and you can exclude look-alike characters such as I, l, 1, O and 0 for passwords you will need to read off a screen or dictate over the phone. The strength meter shows entropy in bits, which is the only meaningful way to compare passwords: it tells you the size of the space an attacker has to search, independent of any particular guessing strategy.

  • Cryptographically secure. Uses crypto.getRandomValues(), not Math.random(), whose output is predictable.
  • Unbiased character selection. Rejection sampling ensures every character is equally likely, so the entropy figure is honest.
  • 4 to 128 characters. Choose exactly the length a site allows, with a live strength readout as you adjust it.
  • Exclude look-alikes. Remove I, l, 1, O, 0, S, 5, B and 8 for passwords you will read aloud or type by hand.
  • Satisfies strict rules. Guarantee at least one character from each enabled set, then shuffle so position leaks nothing.
  • Never leaves your device. Generated locally and not stored anywhere — no logs, no local storage, no history.

Frequently asked questions

Is this password generator actually safe to use?

Yes, and the reason is structural rather than a matter of trust: the password is generated by JavaScript running on your own device, using your browser’s cryptographic random source. It is never sent over the network, so there is no server that could log it. You can verify this yourself by opening your browser’s network inspector while generating — you will see no requests.

Why not use Math.random()?

Math.random() is a fast pseudo-random generator designed for simulations and games, not secrecy. Its internal state can be reconstructed from a modest number of observed outputs, after which all future and past values are predictable. crypto.getRandomValues() draws from the operating system’s entropy pool and is designed specifically to resist that. For anything used as a secret, the difference is decisive.

How long should my password be?

For an account protected by a password manager, 16–20 random characters is comfortably beyond brute-force reach and is what we would suggest. Below about 12 random characters, a determined offline attack against a leaked password database becomes plausible. Above 24 the marginal benefit is small, since the weakest link stops being the password.

What does "bits of entropy" mean?

It measures the size of the space an attacker must search. Each additional bit doubles that space, so 60 bits is a million times harder than 40. A password of length L drawn uniformly from an alphabet of size N has L × log₂(N) bits. Crucially this only holds when the choice is genuinely random — a human-chosen password that happens to be the same length has far less real entropy, because human choices cluster.

Should I use symbols?

They help, but less than length does. Adding symbols to a 62-character alphabet takes you to about 90, worth roughly half a bit per character. Adding four characters to the length is usually worth more and never breaks a site’s validation rules. If a site rejects symbols, just make the password longer.

Is the same password ever generated twice?

The chance is negligible at any reasonable length. A 16-character password from the full alphabet has around 10³¹ possibilities — you would need to generate passwords for the lifetime of the universe before a collision became likely. Nothing is stored between generations, so each one is drawn independently.

Why exclude quotes and backslashes from the symbol set?

Practicality. Quotes, backticks and backslashes have special meaning in shells, CSV files, connection strings and configuration formats, and a password containing them tends to cause trouble somewhere down the line. Removing four characters from the symbol set costs a fraction of a bit per character, which one extra character of length more than recovers.

Related tools

Tools that pair well with this one.