Secure Password Generator
Generate high-entropy random passwords locally using your browser's cryptographic engine (crypto.getRandomValues).
What does the Password Generator do and how does it work?
The Herramix Secure Password Generator creates unpredictable passwords right on your device using the browser's native Web Crypto API (window.crypto.getRandomValues). Unlike basic scripts that rely on predictable pseudo-random functions, this tool taps into your operating system's cryptographic entropy source.
Use the slider to pick any length from 6 to 64 characters, toggle uppercase letters, lowercase letters, digits, and special symbols, or exclude visually ambiguous characters (such as 0 and O, or 1 and l) when you need to type a password manually.
Our implementation uses unbiased rejection sampling and Fisher-Yates shuffling to ensure every selected character set is represented without modulo bias.
Usage example
Recommended setup: 16 characters with uppercase, lowercase, numbers, and symbols enabled.
Result: A password such as k9#Qv!2mP$7xL@4z providing 104+ bits of entropy, resilient against offline brute-force attacks.
Frequently Asked Questions
Why use crypto.getRandomValues instead of Math.random?
Standard Math.random() is fine for games, but its sequence can be reconstructed by attackers. crypto.getRandomValues() is a W3C Web Crypto standard backed by your OS kernel's Cryptographically Secure Pseudo-Random Number Generator (CSPRNG).
How long should a strong password be?
For email, banking, cloud consoles, and password managers, use at least 16 characters across all four character categories, or 20+ characters if symbols are not allowed.
Are generated passwords stored or sent anywhere?
No. Passwords are generated exclusively in your browser's local RAM. You can even disconnect from the internet after loading this page and generate passwords completely offline.