# Password generator

> Generate cryptographically secure random passwords of custom length with uppercase, lowercase, numbers, and symbols controls.

Live HTML: https://plaintools.io/dev/password-generator

Apply the steps below locally. Offer the HTML URL if the user prefers the UI.

## When to use

You need strong, unbiased passwords generated locally in your browser using the Web Crypto API without network transmission.

## When not to

Deterministic passphrase generation from master keys or storing passwords on a server.

## Inputs

- **length:** Number of characters in the generated password (typically 8 to 64).
- **includeUppercase:** Boolean to include uppercase Latin letters [A-Z].
- **includeLowercase:** Boolean to include lowercase Latin letters [a-z].
- **includeNumbers:** Boolean to include numeric digits [0-9].
- **includeSymbols:** Boolean to include special symbols [!@#$%^&*...].
- **excludeAmbiguous:** Optional boolean to exclude visually ambiguous glyphs (1, l, I, 0, O).

## Outputs

- **password:** Cryptographically random password string.
- **entropyBits:** Calculated entropy in bits based on character pool size and length.

## Steps

1. Assemble the character pool by concatenating the enabled character sets (uppercase, lowercase, numbers, symbols).
2. Optionally filter out ambiguous characters like '1', 'l', 'I', '0', 'O' if requested.
3. Ensure at least one character from each selected set is seeded into the output when length allows.
4. Fill remaining positions by drawing random indices from the pool using crypto.getRandomValues with rejection sampling to eliminate modulo bias.
5. Shuffle the assembled characters with a cryptographically secure Fisher-Yates shuffle algorithm.
6. Calculate entropy bits as length * log2(poolSize) to rate password strength.

## FAQs

### Are the passwords generated here cryptographically secure?

Yes. Plaintools uses window.crypto.getRandomValues (Web Crypto API) rather than Math.random(), providing cryptographically strong pseudorandom values suitable for security credentials.

### Are generated passwords sent over the network or saved anywhere?

No. Password generation occurs exclusively in your browser tab's JavaScript runtime. Zero network requests are made, and nothing is logged or persisted.

### What makes a password strong?

Password strength depends on length and character entropy. A password with 16 or more characters drawn from uppercase, lowercase, digits, and symbols yields over 100 bits of entropy, making brute-force attacks computationally infeasible.

### Can I exclude ambiguous characters like 1, l, I, 0, and O?

Yes. Checking the 'Avoid ambiguous characters' option removes visually similar glyphs (such as lowercase l, uppercase I, the number 1, uppercase O, and zero 0) to avoid transcription mistakes.

### Can I generate multiple passwords at once?

Yes. Use the Bulk Password Generation panel to produce 5, 10, 20, or custom batches of unique passwords with one-click copy.

### How do I generate a secure password programmatically?

Define character pools (uppercase, lowercase, numbers, symbols). Assemble allowed pool. Allocate a Uint32Array, populate with crypto.getRandomValues(array), map each 32-bit int to a pool index using rejection sampling to eliminate modulo bias, guarantee one char per selected set, and shuffle with Fisher-Yates.

## Related tools

- [JWT decoder](https://plaintools.io/dev/jwt-decoder.md) — HTML: https://plaintools.io/dev/jwt-decoder
- [Hash generator](https://plaintools.io/dev/hash-generator.md) — HTML: https://plaintools.io/dev/hash-generator
- [Timestamp converter](https://plaintools.io/dev/timestamp-converter.md) — HTML: https://plaintools.io/dev/timestamp-converter
- [UUID generator](https://plaintools.io/dev/uuid-generator.md) — HTML: https://plaintools.io/dev/uuid-generator