Generate Secure Passwords and Random Tokens

Q: Does the generator use Math.random()?

No. It uses crypto.getRandomValues() from the Web Crypto API.

Q: What does excluding ambiguous characters remove?

It removes I, l, 1, O, and 0 from selected character groups.

Web Crypto

A password is much harder to guess when it is long, unique, and drawn from a cryptographically secure source of randomness. The Password & Secret Generator creates random passwords, hexadecimal tokens, and Base64URL tokens in the browser using crypto.getRandomValues() from the Web Crypto API, not Math.random(). Password mode supports configurable character classes and lengths from 4 to 128 characters; token modes generate 16 to 64 random bytes (128 to 512 bits before encoding). Generation is only the first step — a strong secret still needs secure storage, careful transfer, and rotation.

Open Password Generator

Quick answer. Choose Password mode for a credential a person or password manager will enter. Choose Hex or Base64URL when an application expects encoded random bytes. Prefer long, unique values, store them in a trusted password manager or secrets system, and never reuse them across accounts or environments.

Three generation modes

Mode	Output alphabet	Length control	Common uses
Password	Selected upper, lower, number, and symbol characters	4–128 characters	Account passwords, software passcodes, temporary credentials
Hex token	`0-9` and `a-f`	16, 24, 32, 48, or 64 random bytes	API secrets, signing keys, identifiers, config values
Base64URL token	Letters, numbers, `-`, and `_`	16, 24, 32, 48, or 64 random bytes	URL-safe tokens, session secrets, web app config

All three use the same browser cryptographic-randomness source and encode results differently. An encoded token is not automatically suitable for every application — always check the required format, length, and secret-generation guidance of the system that will consume it.

Password mode

Password mode creates a string from the character groups you select:

Uppercase letters: adds A through Z.
Lowercase letters: adds a through z.
Numbers: adds 0 through 9.
Symbols: adds !@#$%^&*()_+-=[]{}|;:,.<>?. Some websites accept only a subset of punctuation; if a password is rejected, check that service's requirements rather than weakening or reusing another credential.
Exclude ambiguous characters: removes I l 1 O 0, which helps when a password must be typed or read from another device. It slightly reduces the alphabet, so compensate with adequate length.

The interface supports lengths from 4 to 128 characters. The shortest values should not be treated as strong merely because they were randomly generated. Follow the target system's security policy and prefer a longer unique password whenever it is accepted.

Every selected character class is represented

The generator does not simply draw every character independently from one combined pool. It first selects at least one character from each enabled class, fills the remaining positions from the complete selected alphabet, and then shuffles the result using the same cryptographically secure random-number process.

So if uppercase, lowercase, numbers, and symbols are enabled, a generated password contains at least one character from each group — provided its length is large enough to contain all selected groups. The final shuffle prevents the required characters from always appearing in predictable positions.

Hexadecimal token mode

A hex token represents each random byte using two hexadecimal characters:

Random bytes	Random bits	Hex characters
16	128	32
24	192	48
32	256	64
48	384	96
64	512	128

Hex is simple, case-insensitive in many systems, and easy to inspect. Its main cost is length: two text characters per byte. A 64-character hexadecimal value represents 32 random bytes, not 64.

Base64URL token mode

Base64URL is a URL- and filename-friendlier variation of Base64. It replaces + with - and / with _, and the generator also removes trailing = padding. Approximate output lengths:

Random bytes	Random bits	Base64URL characters (no padding)
16	128	22
24	192	32
32	256	43
48	384	64
64	512	86

Base64URL carries the same random bytes in fewer characters than hexadecimal. It is an encoding, not encryption, hashing, or a signed token format.

How to generate a strong password

1. Use Password mode. Choose Password when the destination expects a credential made from ordinary keyboard characters.
2. Review the destination's rules. Check minimum and maximum length, required character types, forbidden symbols, and whether spaces or Unicode characters are accepted.
3. Select useful character groups. Enable the groups the destination accepts. A large alphabet increases the possible output space, but length and uniqueness matter more than satisfying arbitrary complexity patterns with a short password.
4. Choose adequate length. Prefer a long value the destination can store correctly. Password-manager-generated credentials can be longer because they are not memorized or typed frequently.
5. Generate the result. Create one or more values; each is independently generated from browser cryptographic randomness.
6. Store it immediately. Save the password directly in a trusted password manager. Avoid temporary notes, screenshots, unencrypted documents, chat messages, or email drafts.
7. Clear exposed copies. Clear the visible results when finished. If the secret was copied, consider clipboard history and other applications that may access the clipboard.

How to generate an application secret

1. Read the application's documentation. Do not guess the required format. A system may require exactly 32 bytes, a particular encoding, a prefix, or a secret produced by its own key-management process.
2. Choose Hex or Base64URL. Use the encoding the application explicitly supports. Hex and Base64URL can represent the same randomness with different text lengths.
3. Select the byte length. Choose 16, 24, 32, 48, or 64 bytes based on the requirement. More bytes do not automatically improve a system that truncates or mishandles the value.
4. Store the secret in the correct system. Use an environment-specific secrets manager, encrypted configuration store, hardware security module, or approved deployment platform. Do not commit secrets to source control.
5. Restrict and rotate access. Limit who and what can read the secret, and establish a rotation procedure before it is exposed or expires.

How secure random selection works

Web Crypto instead of Math.random. Math.random() is designed for general-purpose simulation and interface behavior, not credentials, and its output is not required to resist prediction. The generator uses crypto.getRandomValues(), which asks the browser for cryptographically strong random values suitable for security-sensitive use.

Rejection sampling avoids modulo bias. Converting a random integer into a character index with a simple remainder can make some characters slightly more likely when the random-number range is not evenly divisible by the alphabet size. The implementation rejects values outside an evenly divisible range and draws again before applying the remainder, keeping character selection unbiased.

Fisher–Yates shuffle randomizes guaranteed positions. After selecting at least one character from every enabled class, the generator shuffles all positions using secure random indexes. Without that step, the first character might always be uppercase, the next lowercase, and so on.

Understanding the entropy estimate

Entropy is commonly expressed in bits and describes the size of a random search space. The tool estimates password entropy as length × log2(number of available characters). For token modes, the displayed estimate is random bytes × 8.

This estimate assumes the generator works as intended and the result stays random and secret. It does not measure the complete security of an account or application, and it does not account for password reuse, phishing, malware or keyloggers, clipboard exposure, database breaches, weak password-reset procedures, insecure storage, sharing through the wrong channel, or a lack of rate limits and multifactor authentication. A high entropy number cannot compensate for exposing the password.

Passwords, passphrases, tokens, and keys

Password

A secret string accepted by an authentication system. A password manager can store a long random value a person does not memorize.

Passphrase

A sequence of randomly selected words. The current tool generates character-based passwords, not word-list passphrases.

Token

An encoded random byte sequence used as an API key, session secret, recovery value, or configuration secret when the receiving system supports it.

Encryption key

A cryptographic algorithm can require a precisely sized binary key and specific generation procedures. Do not assume a displayed text token is a valid key for every library.

Hash

A one-way digest derived from input. Random token generation is not hashing, and a Base64URL string is not a hash merely because it looks technical.

Safe password and secret handling

Use a password manager. Store account passwords in a trusted manager that can autofill them without memorization or reuse.
Use multifactor authentication. Enable phishing-resistant MFA where available; it adds another control when a password is stolen.
Never reuse credentials. Every account and environment should have its own secret. Reuse turns one breach into several compromises.
Keep secrets out of source code. Do not hard-code API keys or commit .env files with real credentials; repository history can preserve a secret after the visible line is removed.
Separate environments. Development, testing, staging, and production should use different secrets. Production credentials should not appear in sample configuration or on developer laptops unless explicitly controlled.
Rotate exposed secrets. If a value appears in logs, screenshots, source control, tickets, email, or public chat, treat it as exposed and replace it. Deleting the visible message is not sufficient.

Privacy and data handling

Passwords and tokens are generated in browser memory using Web Crypto and are not sent to WeConvertFiles for generation. The generator does not intentionally write results to local storage or a server.

If a visitor consents to site analytics, separate usage information such as page visits, clicks, device details, or generation events may be collected. Those analytics do not receive the generated secret values.

The local device still matters. Browser extensions, malware, remote-access software, screen recording, clipboard managers, shared accounts, and cloud-synchronized notes can expose generated secrets independently of the tool.

Limitations and important cautions

The generator is not a password manager. It creates values but provides no durable encrypted storage, autofill, sharing controls, or recovery.
Entropy is an estimate. It does not guarantee that an account or application is secure.
Destination rules vary. Some systems reject particular symbols, lengths, or encodings.
The clipboard can retain secrets. Copying is convenient but creates another place the value may be exposed.
Base64URL is not encryption. It only encodes random bytes as text.
More bytes are not always useful. Follow the consuming system's specification.
No word-list passphrases. Password mode uses selected character classes.

Troubleshooting

The website rejects the generated password

Check its maximum length and allowed symbols, then generate a new password using accepted character groups. Do not modify the value into a predictable pattern or reuse an existing credential.

A selected character type appears to be missing

Generation guarantees at least one character from each selected class when the length can contain all enabled groups. Confirm the option was enabled and generate a fresh value.

The password contains a confusing character

Enable ambiguous-character exclusion to remove I, l, 1, O, and 0.

Copy does not work

The browser may block clipboard access. Select the visible result manually and copy it, then handle clipboard history appropriately.

The Base64URL token has no equals signs

The generator intentionally removes trailing Base64 padding and uses URL-safe - and _ characters.

A 32-byte token is not 32 characters long

Bytes and encoded characters are different units. Thirty-two bytes produce 64 hex characters or about 43 unpadded Base64URL characters.

The entropy number seems unexpectedly high or low

The estimate depends on the chosen alphabet and length in Password mode, or the byte count in token modes. It does not measure storage or account security.

Frequently asked questions

Does the generator use Math.random()?

No. It uses crypto.getRandomValues() from the Web Crypto API.

Does every selected character class appear in a password?

Yes, when the password length is at least the number of selected classes. The characters are then securely shuffled so their positions are not predictable.

What does excluding ambiguous characters remove?

It removes I, l, 1, O, and 0 from selected character groups.

How long can a generated password be?

Password mode supports lengths from 4 to 128 characters. A short available setting should not be treated as strong merely because it is random.

What token sizes are available?

Hex and Base64URL modes support 16, 24, 32, 48, and 64 random bytes—128 to 512 bits before encoding.

Is Base64URL encrypted?

No. Base64URL is an encoding. Anyone who has the string has the underlying random bytes.

Are generated passwords saved or transmitted?

The values are generated in browser memory and are not sent to WeConvertFiles for generation or intentionally persisted by the tool.

Is a generated token suitable as an encryption key?

Only if the cryptographic system explicitly accepts that size and encoding. Follow the library or protocol's key-generation requirements.

Should I memorize a generated password?

Long unique passwords are usually best stored in a trusted password manager rather than memorized or simplified.

What should I do if a generated secret is exposed?

Revoke or rotate it immediately in the system where it is used. Generating another value does not disable the exposed one automatically.

Generate a strong secret

Pick Password, Hex, or Base64URL, choose a length or byte count, and store the result in a trusted password manager or secrets system.

Use Password Generator