YUCTS Tools

Secure Password Generator (cryptographic, unbiased)

Create random passwords in your browser with a cryptographically secure, unbiased generator (crypto.getRandomValues). Choose length, character types and look-alike exclusion, and see the entropy.

  • Runs in your browser (no upload)

8–128 characters

1–100

Characters to use

Every password contains at least one character of each selected type (chosen without bias).

Excluded: 0 O o 1 I l | ` ' "

Generated passwords

Character pool
94 characters
Entropy (per password)
130.9 bits
Strength
Very strong

Entropy is the number of guesses, as a power of two, that a brute-force attack needs even if the attacker knows these settings (length and character types). Rule of thumb: under 50 bits is weak, 75 bits or more is strong, 100 bits or more is very strong.

Generating…

Passwords are created in this browser and are never saved, sent or logged. They disappear when you close the page, so store the one you use in a password manager.

How to use

  1. Enter the password length (8–128 characters) and how many passwords you need (1–100).
  2. Choose the character types (uppercase, lowercase, digits, symbols) and optionally exclude look-alike characters.
  3. Copy the password you want to use. Press "Generate again" for a fresh set.

FAQ

What kind of randomness is used?

The browser's crypto.getRandomValues (a cryptographically secure random number generator). Each character is picked with rejection sampling so there is no modulo bias. Math.random is never used.

How can every selected type be included without bias?

Every character is drawn uniformly from the whole pool, and a candidate that misses one of the selected types is discarded entirely and drawn again. As a result every valid password is equally likely, unlike "insert one of each type, then shuffle", which favors small sets.

Which characters count as look-alikes?

Ten characters: digit 0 and letters O and o, digit 1 and letters I and l, the vertical bar |, and the quote-like marks ` ' ". Excluding them makes the pool smaller, so the entropy for the same length goes down slightly.

How is the entropy calculated?

The exact number of passwords that satisfy your settings is counted with the inclusion–exclusion principle, and its base-2 logarithm is shown. It assumes the attacker knows the length and character types.

Are generated passwords saved or sent anywhere?

No. Passwords are created only inside this page. They are never sent to a server, stored in the browser, put in the URL or logged.

Notes & limitations

  • What you enter is processed only on this page and is not sent to YUCTS servers.
  • Security also depends on how you use the password: do not reuse it across services, and turn on two-factor authentication where possible.
  • Generated passwords disappear when you close the page. Save the one you use in a password manager yourself.
  • Some services restrict symbols or length. If so, turn symbols off or adjust the length.
  • Entropy and strength labels are theoretical values for passwords generated randomly by this method.