Random Password Generator

Generate cryptographically strong, random passwords using browser-native CSPRNG (window.crypto). Features zero modulo bias, customizable length (8–128), character pool selection, and guaranteed zero server transmission.

characters
8 (Min) 16 (Recommended) 32 64 128 (Max)
Security Notice: Generated using native OS entropy via window.crypto.getRandomValues. Zero server tracking.
Included Character Sets:
Generated Secure Passwords Click "Copy" or click text to select
CSPRNG Active
Unbiased rejection sampling • Guaranteed character diversity • Zero server logging

Why Use a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG)?

Many online password generators inadvertently use JavaScript's built-in Math.random() function. In modern browsers, Math.random() is implemented using the xoshiro128+ or v8::base::RandomNumberGenerator algorithms. While fast for games and simulations, these algorithms are not cryptographically secure. An attacker observing a small sequence of outputs can determine the internal PRNG state and accurately predict future generated passwords.

The TechnicalYard Random Password Generator uses the standard Web Cryptography API (window.crypto.getRandomValues). This connects directly to operating system entropy pools (such as /dev/urandom on Unix and Linux systems or BCryptGenRandom on Windows), guaranteeing true statistical randomness and unpredictability.

Eliminating Modulo Bias via Rejection Sampling

A subtle vulnerability in flawed password generators is modulo bias. When selecting a character from a pool of size $N$ using a 32-bit random number $R$ (where $0 \le R < 2^{32}$), simply computing $R \pmod N$ introduces bias if $2^{32}$ is not an exact multiple of $N$. Characters with indices smaller than $2^{32} \pmod N$ have a slightly higher mathematical probability of being selected.

Our implementation uses cryptographic rejection sampling: any random value falling above the largest exact multiple of $N$ is discarded, ensuring every character in your selected pool has an identical, mathematically uniform probability of being chosen.

Step-by-Step Instructions

  1. Select Desired Length: Drag the slider or type a length between 8 and 128 characters (16+ is recommended for general accounts, 24+ for critical root accounts).
  2. Select Character Sets: Check or uncheck Uppercase, Lowercase, Numbers, and Symbols.
  3. Exclude Ambiguous Characters (Optional): Check this option if you plan to write down or manually re-type the password, avoiding visually similar glyphs like 0 and O, or 1 and l.
  4. Choose Batch Count: Select how many candidate passwords you need (up to 20).
  5. Copy: Click the Copy button next to any password to place it on your clipboard.

Frequently Asked Questions

This tool exclusively uses the browser Web Crypto API (window.crypto.getRandomValues), which sources entropy directly from the underlying operating system kernel (e.g. /dev/urandom on Linux/macOS or CryptGenRandom/BCryptGenRandom on Windows). It never uses Math.random(), which is predictable and unsuitable for security credentials.

When mapping a 32-bit random integer to a character set whose size does not divide 2^32 evenly, simple modulo operators (rand % length) disproportionately favor the first few characters. Our generator implements cryptographic rejection sampling, completely discarding out-of-range integer values to guarantee uniform, unbiased character probability across the entire pool.

Never. All password generation and character shuffling execute 100% locally in your web browser tab. No passwords, lengths, or selected parameters are transmitted over the Internet or stored in cookies, localStorage, server logs, or analytics.

Security standards organizations such as NIST (SP 800-63B) recommend a minimum length of 12 to 16 characters for standard user accounts, and 20+ characters for administrative credentials, master encryption passwords, and API tokens. Length provides exponential entropy growth against offline dictionary and brute-force attacks.