KeroTools

Generate a Strong, Random Password

Generate a strong, random password with the length and character types you choose, locally and safely.

The password never leaves your device

Nothing is stored between visits

Platform-grade randomness

Verifiable in your browser

How it works

  1. 1

    Choose a type

    A random string for a password manager, or a passphrase for something you must type by hand.

  2. 2

    Set the length

    Longer is the single most effective change you can make; the character set matters far less.

  3. 3

    Copy it into your manager

    Store it before you close the tab — this page keeps no history, deliberately.

Why use this tool

Cryptographic randomness

Values come from the browser’s secure generator, not a general-purpose one an attacker could reproduce.

Length you control

Length contributes more strength than any symbol rule, and the slider goes far past the usual minimums.

Passphrase mode

Several random words, which is easier to type on a phone and easier to remember than a symbol soup.

Ambiguous characters optional

Exclude `l`, `1`, `O`, and `0` when the password will be read aloud or typed from paper.

Never transmitted

The password is produced in your browser and no request is made, so nothing else ever sees it.

Free, no account

No signup, no watermark, no cap on how many you generate.

Strength comes from how it was chosen, not how it looks

The measure that matters is entropy: how many equally likely possibilities an attacker would have to work through, which depends on the size of the alphabet and the length, and — crucially — on the choice being genuinely random. This is why appearance is such a poor guide. `P@ssw0rd!` satisfies every complexity rule ever written and appears in every cracking dictionary, because the substitutions are the ones everybody makes. Meanwhile a sixteen-character string of nothing but lowercase letters, chosen at random, is far beyond reach. Cracking tools do not try combinations alphabetically; they try leaked passwords first, then dictionary words, then dictionary words with predictable substitutions and a digit on the end. A password only resists that if nothing about it was a human decision.

The composition rules you were taught are now advised against

For two decades the standard advice was a symbol, a digit, mixed case, and a change every ninety days. The current guidance from NIST — the American standards body whose earlier recommendations put those rules everywhere — explicitly reverses both. Mandatory composition rules were dropped because they do not produce randomness; they produce a predictable shape, since almost everyone puts the capital first and the digit and exclamation mark last, which shrinks the search space rather than expanding it. Forced periodic rotation was dropped for the same reason: people asked to change a password every quarter increment a number, and `Spring2024!` becomes `Summer2024!`. What replaced both is length, a check against known breached passwords, and changing a password when there is a reason to believe it is exposed rather than on a calendar.

Why a passphrase is a reasonable answer, with one condition

Not every password lives in a manager. A device login, a disk encryption key, or the master password protecting everything else has to be typed by a human, sometimes on a phone keyboard, sometimes from memory under mild stress. For those, several random words beat a shorter symbol string on both counts: a sequence of five or six words drawn from a large list carries plenty of entropy while remaining memorable and typeable. The condition is that the words must be chosen by the generator, not by you. Human-chosen words cluster heavily around concrete nouns, and a phrase you invented follows grammar and association in ways that dramatically narrow the possibilities. Random words look arbitrary because they are, and that arbitrariness is the entire strength.

A generator is only as good as its randomness

Everything above assumes the source is unpredictable, and that assumption is not free. A generator built on a general-purpose random function — the kind used for shuffling a list or picking a colour — is fast and seeded from something guessable, often the current time. An attacker who knows roughly when a password was generated can regenerate the candidates and search a space of thousands instead of quintillions. This has produced real, documented compromises in wallets and key-generation tools. A password generator must draw from the platform’s cryptographic source, which is what this page uses. The corollary matters just as much: a generator that runs on a server produces the value somewhere you cannot see, and you have no way to know what happened to it afterwards.

Brute force is not the attack you should be planning for

It is worth naming the real threat, because optimising the wrong thing is common. Almost nobody loses an account to a password being guessed character by character. They lose it because the same password was used somewhere else and that other service was breached, and the attacker simply tried the leaked combination everywhere — credential stuffing, which needs no cracking at all. Or they lose it to a convincing login page that captured it directly, where strength is irrelevant because the password was handed over. The defences that actually address these are a different password for every service, which requires a manager because nobody remembers hundreds, and a second factor, which makes a stolen password insufficient on its own. A strong generated password is necessary and is not, by itself, the protection.

Why a generated password must never cross a network

This tool creates the value in your browser and makes no request, and for this particular task that is not a nicety but the whole requirement. A password generated on someone else’s server was known to that server at the moment of creation. Even with the best intentions it may sit in a request log, a load balancer’s buffer, or an error report, and none of that requires anyone to act maliciously. Once a secret has been transmitted, you cannot prove it was not retained, and a password you cannot vouch for is not a secret. You can confirm the behaviour here in the Network tab of your developer tools: generate a password with the panel open and watch that nothing leaves. That is the only version of this tool worth using.

Common mistakes to avoid

  • Trusting a password because it looks complex. `P@ssw0rd!` satisfies every composition rule and sits in every cracking dictionary — strength comes from random choice, not from substitutions everyone makes.
  • Adding symbols instead of length. Length contributes far more entropy than any character-class rule, and a longer all-lowercase string beats a short “complex” one.
  • Choosing the words in a passphrase yourself. Human-chosen words cluster around concrete nouns and follow grammar, which collapses the search space; the generator must pick them.
  • Using a generator built on a general-purpose random function. If it is seeded from the clock, an attacker who knows roughly when you generated can reproduce the candidates.
  • Reusing a strong password across services. Credential stuffing needs no cracking at all — one breach elsewhere is enough, so uniqueness plus a manager matters more than raw strength.

How it compares

AspectThis toolOnline generatorsA password manager
Value crosses a networkNeverOftenNo
Cryptographic randomnessYesUsually unstatedYes
Passphrase modeYesSometimesUsually
Entropy shown in bitsYesRarelySometimes
Stores the result for youNo — by designNoYes
PriceFreeFree / paid tiersFree / paid

Features

Random strings and passphrases

Two modes, because a vault entry and a device unlock code have different requirements.

Uses the platform CSPRNG

The browser’s cryptographic generator, which is the same source your operating system uses for keys.

Character set control

Uppercase, lowercase, digits, and symbols, each switchable for systems with awkward restrictions.

Live strength estimate

Shown as entropy in bits rather than a vague “strong” badge that means nothing.

Bulk generation

A batch at once when you are provisioning several accounts or seeding a test environment.

No history kept

Nothing is stored between visits, so a shared computer does not leak your last generation.

Nothing to install

No extension, no runtime, no dependencies — it runs on the web page.

Arabic and RTL ready

Full interface in eight languages, including right-to-left Arabic.

Secure by default

Served over HTTPS, with no tracking and no third-party requests.

Who uses it

Everyone with more than one account

Producing a unique password per service, which matters more than any single password’s strength.

System administrators

Provisioning credentials for several accounts without a value ever crossing the network.

Developers

Generating a strong secret for a configuration file or a test environment.

Anyone setting a master password

Producing a passphrase that is memorable to type and still genuinely random.

Frequently Asked Questions

No. Every password is generated locally in your browser using the Web Crypto API — nothing is ever sent, logged, or stored.

Yes. They use crypto.getRandomValues — a cryptographically secure random source — not the predictable Math.random. For strong security, use at least 16 characters and enable multiple character types.

No. Everything runs locally in your browser — your text is never uploaded, stored, or shared.

Yes — completely free, with no account and no limits.