How to Generate Secure Passwords Online
100% Client-SidePassword & Secret Generator creates passwords, hex tokens, and Base64URL tokens using crypto.getRandomValues(), the Web Crypto API's cryptographically secure random number generator — Math.random() is never used. Choose your length, character sets, and whether to exclude visually ambiguous characters, or switch to Hex/Base64URL token mode for API keys and session secrets. A live entropy estimate shows the strength of your settings before you generate, and every result is created locally; nothing is ever saved, logged, or transmitted.
Open Password & Secret GeneratorHow It Works
Choose a Mode
Pick Password, Hex Token, or Base64URL Token, then set length and character options.
Generate Securely
crypto.getRandomValues() generates every character with unbiased, cryptographically secure randomness.
Copy Your Secrets
Generate multiple results at once, then copy individually or all at once — nothing is ever saved.
Frequently Asked Questions
Is Math.random() ever used to generate my passwords?
No. Every character and byte is generated using crypto.getRandomValues(), the Web Crypto API's cryptographically secure random number generator. Math.random() is not suitable for secrets and is never used here.
Are my generated passwords saved or sent anywhere?
No. Generation happens entirely in your browser's memory. Nothing is written to storage, logged to a server, or transmitted over the network.
What is the difference between a password, hex token, and Base64URL token?
A password is a human-typeable string built from the character sets you choose. A hex token encodes random bytes as hexadecimal (0-9, a-f), and a Base64URL token encodes random bytes using the URL-safe Base64 alphabet — both are common formats for API keys and session secrets.