Password Generator

Generate a password

How this actually works

• Uses the Web Crypto API's crypto.getRandomValues() — a cryptographically secure random number generator, not Math.random(), which was never designed to be unpredictable.
• Character selection uses rejection sampling to avoid modulo bias, a subtle mistake in many password generators that quietly makes some characters more likely to appear than others.
• If you select more than one character type, one of each is guaranteed to appear — then the whole password, including where those guaranteed characters end up, is shuffled using the same secure randomness.
• Nothing is sent anywhere. The password is generated and stays entirely in this browser tab — close or reload the page and it's gone for good.

From a terminal

These generate a password the same way this page does — locally, using your machine's own cryptographically secure random number generator — with nothing sent to any server. There's deliberately no curl-based option here, unlike the IP tool: a password generator that has to ask a server for the password isn't one where "nothing is sent anywhere" is actually true anymore.

macOS / Linux (bash, zsh)

Reads raw bytes from /dev/urandom and keeps only the ones matching the allowed character set — no modulo, so no bias:

LC_ALL=C tr -dc 'A-Za-z0-9!@#$%^&*()-_=+' < /dev/urandom | head -c 20; echo

Change 20 to any length, and edit the character ranges in the tr set to change what's allowed.

Windows PowerShell

Uses RandomNumberGenerator, not Get-Random — Get-Random is not cryptographically secure and shouldn't be used for anything security-sensitive. This does its own rejection sampling for the same reason the browser version does:

$chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_=+'
$rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
$bytes = New-Object byte[] 1
$limit = 256 - (256 % $chars.Length)
-join (1..20 | ForEach-Object {
  do { $rng.GetBytes($bytes) } while ($bytes[0] -ge $limit)
  $chars[$bytes[0] % $chars.Length]
})

Works in both Windows PowerShell 5.1 (built into every Windows install) and PowerShell 7+. Paste the whole block at once.

Windows cmd.exe

cmd.exe has no built-in cryptographic random source at all, and there isn't a clean, reliable way to fake one in a single command. The straightforward path: type powershell to start a PowerShell session from within cmd — it's on every Windows machine — then run the PowerShell block above.