Password Generator

Random passwords that never touch our servers

A good password is long, random, and unique. Humans are bad at all three. This password generator builds a string from the character sets you enable, using crypto.getRandomValues—not Math.random. The result appears on the page and nowhere else. There is no “save to account,” because KindCalc does not have your vault.

Use a password manager to store what you generate. A generator without a vault just creates a secret you will forget or, worse, reuse after writing it in a notes app.

How the randomness works

Each character index is chosen with a uniform mapping from CSPRNG bytes onto the allowed alphabet. The generator rejects biased samples so a 70-character alphabet does not overweight the first symbols. If you disable digits or symbols, the alphabet shrinks and you should add length to keep guessing hard.

This is not a passphrase of dictionary words. Word-list passphrases can be strong too, but they are a different design. Sites that ban pasting or cap length at 12 characters are the weak link; no generator can fix a 12-character maximum on a bank that still allows “Winter2024!”

How to use it

Set a length (16 is the default). Toggle uppercase, lowercase, digits, and symbols. Optionally drop look-alike characters if you must read the password aloud. Generate, copy, paste into the signup form and into your manager in the same sitting. If a site rejects symbols, turn symbols off and generate again rather than editing by hand—manual edits reintroduce patterns.

Do not email yourself the password. Do not generate on a shared screen during a stream. Do not QR-encode a password and tape it to a monitor; the QR tool is for URLs and public strings.

What “strong” means here

Strength is mostly length times alphabet size, assuming true randomness and no reuse. A 16-character mixed password is in a different league than a 10-character movie quote. Passkeys and manager-generated secrets are still better than anything you memorize for every site.

If you need to type a Wi-Fi password onto a TV, excluding look-alikes is reasonable. If a manager will autofill, keep the full alphabet and more length.

Threats this page does not solve

Phishing, malware, and a compromised clipboard manager can steal a perfect password. 2FA still matters. This tool does not know whether the site you are joining hashes passwords well. It only gives you a better secret than “Password1.”

The generator will not produce the same password twice on purpose, but it also will not remember what it produced. Copy it now.

Typical examples

Frequently asked questions

Is a browser password generator safe?

This one uses crypto.getRandomValues, the same kind of CSPRNG browsers expose to web apps. The password is not sent to KindCalc. You should still store it in a password manager, not in email.

How long should a password be?

Length beats clever substitutions. 16 characters from a large alphabet is a solid default for unique site passwords stored in a manager. Important accounts can go longer if the site allows it.

Why exclude look-alike characters?

0/O and 1/l/I are painful when you must type a password from a screen. Excluding them slightly reduces the alphabet. Compensate with a bit more length if you care.

Should I reuse this password?

No. Generate one password per account. Reuse is how one breach becomes five.

Do you save generated passwords?

No. Closing the tab forgets them. Copy to a password manager immediately.