Password Generator
Strong passwords, generated in your browser by your operating system's random source. Never transmitted, never stored.
How to generate a strong password
- 1
Pick a length
Longer beats clever. Length adds more strength per character than any of the other settings, and a password manager means you never type it anyway.
- 2
Choose the character sets
Leave all four on unless something you are signing up to refuses symbols. Every set you switch off shrinks the pool the password is drawn from.
- 3
Check the strength line
It shows the entropy in bits and roughly how long the password would survive a fast offline attack. Aim comfortably past 80 bits.
- 4
Copy it into your password manager
Straight into the manager, not into a note or a message. The password only exists in this tab until you copy it, and the tab forgets it the moment you leave.
Length is the setting that matters
Password advice spent two decades pushing complexity — a capital, a number, a symbol — and the result was a generation of passwords that satisfied the rules and defeated nobody. The capital went at the front, the number and the symbol went at the end, and attackers learned that pattern long before the rest of us did.
What actually resists guessing is size of the search space, and length is the cheapest way to buy it. Each extra character multiplies the space by the size of the pool; each extra character set only widens the pool once. Going from twelve characters to twenty is worth far more than adding symbols to a short one, and it costs you nothing when a password manager does the typing.
This is why the strength line here reports bits rather than a word like "strong". Bits are comparable and they compound: every extra bit doubles the work an attacker has to do. Around 60 bits is uncomfortable, 80 is a reasonable floor for anything that matters, and past 100 the password stops being the weakest thing about the account by a wide margin.
Where the randomness comes from
A password is only as unguessable as the source that produced it, so it is worth knowing what this uses. Characters are drawn with crypto.getRandomValues, the cryptographic generator your operating system provides — not Math.random, whose output can be predicted from earlier values and which has no business generating a secret.
Drawing a character fairly takes slightly more care than it looks. The obvious approach — take a random number and reduce it modulo the alphabet size — is subtly wrong, because the alphabet almost never divides evenly into the range, so the first few characters come up marginally more often than the rest. The skew is small, but it is free to avoid: values landing in the uneven tail are discarded and a fresh one is drawn. That, and the shuffle that mixes in the guaranteed characters, are unit-tested — they are precisely the kind of code that looks correct while being quietly biased.
The password is never sent anywhere from this page. It is built in the tab, shown to you, and forgotten when you navigate away. There is no request to inspect, nothing in a log, and no policy you have to take on faith.
Frequently asked questions
Not when you use this page. It is generated in your browser by crypto.getRandomValues, the random source your operating system provides, and it never leaves the tab — you can watch the network panel stay silent, or disconnect from the internet after the page loads and keep generating. Nothing is stored and nothing is logged.
Yes, and that is worth being straight about. The REST endpoint and the MCP tool generate on the server and send the result back over TLS. Nothing is stored or logged, but the password does travel, which the browser version never does. Use the API for scripts and agents; use this page for a password you actually care about.
Long enough that the strength line reads comfortably past 80 bits, which with all four character sets on means roughly 13 characters or more. Twenty is a good default and costs you nothing, because a password manager types it for you. Length buys more strength per character than any other setting here.
It is the number of bits needed to describe every password the current settings could have produced, assuming an attacker knows those settings. Each extra bit doubles the work. It measures the process rather than the string, which is why a password manager's random output at 80 bits is genuinely strong while a human-chosen one that merely looks similar is not.
Because it rules out every password that happens to miss a set, so there are fewer possible outcomes. The reduction is under a bit at realistic lengths — far less than the cost of a site rejecting your password and pushing you toward something weaker. The figure shown is the plain estimate for the pool and length.
Only when a human has to read the password — off a projector, over the phone, from a printed sheet. It removes the pairs that get confused, l against 1 and I, O against 0. It also shrinks the pool, so add a character or two to compensate. If the password lives in a manager and is never read aloud, leave it off.
No. Math.random is not a cryptographic generator: its output is predictable from previous values, which is fine for shuffling a playlist and unfit for a secret. This uses crypto.getRandomValues in the browser and the equivalent on the server. The unbiased integer draw on top of it is unit-tested, because taking a modulo of a random number quietly skews the result.
On this page, press "New one" as many times as you need. Over the API, pass count up to fifty — that is the case the endpoint exists for, seeding a batch of service accounts or fixtures from a script.
For something you have to type or remember, often yes — several random words are easier to handle at the same strength. For everything living in a password manager, which should be nearly everything, a long random string is simpler and shorter. This tool makes the second kind.
No. It is MIT licensed and there is no account, no watermark, no limit and no upsell. The code that generates the password is a few dozen lines you can read in the repository, which is rather the point for a tool like this — a password generator you cannot inspect is asking for a lot of trust.
API — for scripts and agents
The same generator behind a free REST endpoint, for seeding a batch of accounts or fixtures. No API key, no sign-up. It returns the password with its entropy and crack time.
curl 'https://zeal.tools/api/v1/password?length=24&count=3' Be aware of the trade: a password generated here travels over the wire, which one made in your browser never does. Nothing is stored either way. MCP clients can call the same core — add https://zeal.tools/mcp and use the generate_password tool.
The Zeal Promise
Non-negotiable, on every tool we ship.
- No sign-up — ever
- No watermarks on any output
- No ads near the download button
- Works fully on mobile
- Privacy-first: processing stays in your browser
- Open source (MIT) — audit it, contribute, self-host
- Zero runtime dependencies in tool logic