Password generator
Generate random passwords with adjustable length and character sets.
How to use this tool
Generate random passwords in your browser with adjustable length and optional symbols.
Stop reusing passwords or using predictable birthdates. This tool generates high-entropy, cryptographically secure passwords locally in your device using CSPRNG. Protect your digital identity with custom lengths and symbols.
💡 3 Quick Steps to Get Started
Slide to your desired length (14–16+ characters recommended for strong security).
Toggle uppercase, lowercase, numbers, and special symbols, or exclude ambiguous characters (like 0 and O).
Click Copy to instantly paste into your password manager or new account registration.
When it helps
Create a password for a new account or password rotation without sending the result to a server.
How it works
Uppercase, lowercase, and numbers are always enabled, while symbols are optional. Each character is selected independently from the combined alphabet with crypto.getRandomValues when available, without guaranteeing every class appears. If unavailable, the code silently falls back to Math.random. Use a unique password of at least 16 characters for an important account.
Worked example
Example: generate a 20-character password with symbols, or disable symbols only when a site rejects them.
Limits and data handling
If crypto.getRandomValues is unavailable, the code silently uses Math.random. That fallback is not cryptographically secure and should not be used for an important account. Even with secure randomness, use a unique password of at least 16 characters and store it in a trusted password manager.
Password and settings stay in the current browser and are not uploaded to or retained by GoGo Tools. Analytics may record the tool identifier, category, and locale, but not length, symbol setting, generated password, or result content.
Cryptographic Security, Password Entropy & Defense Handbook
1. Mathematical Foundation of Password Entropy
In modern cybersecurity, brute-force resistance is measured by Information Entropy (expressed in bits). Entropy quantifies the sheer combinatorial search space an adversary must explore during exhaustive dictionary attacks or GPU hash cluster cracking.
The formula is: E = L × log2(R), where L represents character length and R represents the character pool size (e.g., lowercase only R=26; alphanumeric R=62; full ASCII printable symbols R=94). A 16-character fully randomized string yields over 105 bits of cryptographic entropy, rendering offline GPU rainbow table and cracking attacks computationally infeasible.
2. NIST SP 800-63B Digital Identity Guidelines
The National Institute of Standards and Technology (NIST) Special Publication 800-63B outlines evidence-based credential policies:
1. Eliminating Arbitrary Periodic Expirations: Forcing 90-day resets encourages predictable transformation patterns (e.g., Winter2026!).
2. Favoring Passphrases: Multi-word sequences (4+ random words) achieve massive entropy while remaining humanly memorable.
3. Unique Per-Service Credentials: Never reuse credentials across domains to prevent credential stuffing exploits from secondary breaches.
- Maintain at least 80 bits of entropy for master passwords and primary email anchors.
- Combine strong passcodes with hardware security keys (FIDO2/WebAuthn) or TOTP authenticators.
3. CSPRNG vs. Pseudo-Random Number Generators (PRNG)
Standard math functions (such as `Math.random()`) use deterministic PRNG algorithms that are vulnerable to state-recovery attacks. Our generator exclusively leverages `window.crypto.getRandomValues()`, sourcing entropy from hardware timing noise directly from the operating system kernel.
4. Zero-Knowledge Local Memory Processing
Passwords generate purely within local client RAM. No network requests, server logs, or telemetry are ever dispatched, preventing interception vectors.
Feedback
How can we improve this tool?
Send a suggestion or bug report for this tool.
FAQ
Password generator: Which inputs can I adjust?
Length must be 4 to 128. Uppercase letters, lowercase letters, and numbers are always enabled; only symbols can be toggled. The alphabets omit some easily confused characters.
Password generator: How is a password produced?
Each position is selected independently from the combined alphabet using crypto.getRandomValues when available. The tool does not force at least one character from every class, so check the target site composition rules.
Password generator: What security limitations apply?
If crypto.getRandomValues is unavailable, the code silently uses Math.random. That fallback is not cryptographically secure and should not be used for an important account. Even with secure randomness, use a unique password of at least 16 characters and store it in a trusted password manager.
Password generator: How are my password and settings handled?
Password and settings stay in the current browser and are not uploaded to or retained by GoGo Tools. Analytics may record the tool identifier, category, and locale, but not length, symbol setting, generated password, or result content.
