>_
***

Password & API Key Generator

Generate strong random passwords and secret tokens (hex, base64url, base62) with the Web Crypto API. Shows entropy in bits, excludes look-alike characters on request, and never sends anything over the network.

Runs locally — your input never leaves this page.

    How to use

    1. Choose a length and which character sets to include. Turn on “Exclude look-alikes” to avoid characters such as l, 1, O and 0.
    2. The strength meter shows entropy in bits — aim for 80+ bits for accounts and 128+ bits for secrets.
    3. Switch to Token mode for API keys, session secrets or JWT signing keys in hex, base64url or base62.

    FAQ

    Are these passwords truly random?

    Yes. Characters are picked with crypto.getRandomValues() using rejection sampling, so every character is equally likely. Nothing is generated or logged on a server.

    How long should a secret key be?

    32 random bytes (256 bits) is a common choice for HMAC and JWT signing keys and session secrets. Store secrets in environment variables or a secret manager, never in source code.

    Report a bug or suggest a feature →