Toolkit Shelf
Find

Secure Password Generator

Use this browser-only password generator to create a unique random password without uploading or saving the generated value on Toolkit Shelf.

Deterministic method

Browser-only generator

Secure password generator

Generated password
Choose options, then generate a password.
Privacy and security boundary

Generation happens in this browser with Web Crypto. The password is not uploaded or saved by Toolkit Shelf. Entropy is an estimate, not a guarantee; use a password manager and unique credentials for important accounts.

Store the generated password in a trusted password manager, keep it unique to one account, and confirm the destination accepts the selected length and characters. Do not paste real passwords into feedback or support messages.

Generation method

Secure random generation method

Password = Web Crypto random selections from the enabled character sets, including at least one character from every enabled set

Selection uses rejection sampling to avoid modulo bias. The displayed entropy is an approximate search-space estimate and is not a security guarantee.

How to use

Steps

  1. Choose a password length from 4 to 128 characters.
  2. Enable the character sets accepted by the destination account.
  3. Optionally exclude characters that are easy to confuse when read or typed.
  4. Generate, copy, and store the password in a trusted password manager.

Example

Sample output

Default length20 characters
Default setsLowercase, uppercase, numbers, and symbols
ProcessingIn this browser

Generator use

Best for

  • Creating a unique credential for a new account before saving it in a trusted password manager.
  • Replacing a reused or guessable password with a longer random value.
  • Matching a destination's allowed length and character-set rules without sending the result to Toolkit Shelf.
  • Generating a credential locally when the account or password manager does not provide its own generator.

Before relying on it

Check first

  • Do not reuse a generated password across accounts, especially for email, banking, work, or recovery access.
  • Copying the password into chat, email, screenshots, shared documents, analytics fields, or any other exposed location.
  • Treating the approximate entropy figure as proof that the account itself is secure.
  • Leaving the page before storing the password safely or confirming that the destination accepted it.

Details

What to know before using the output

Random sourceWeb Crypto

The browser supplies cryptographically strong random bytes through crypto.getRandomValues.

Character coverageEvery enabled set

Each generated password includes at least one character from every enabled character set.

Storage boundaryNot uploaded or saved

Toolkit Shelf does not send the generated password to its server or save it to an account.

Source notes

References used for this generator

MDN Web Docs - Crypto.getRandomValuesDocuments the browser API used to obtain cryptographically strong random values.NIST SP 800-63BProvides current password and authenticator guidance, including length, blocklists, password managers, and rate limiting.

Benchmarks

How to read the output

20 characters: Default.

A practical starting length when the destination accepts all enabled character sets.

Unique per account: Essential.

Do not reuse a generated password across important accounts.

Password manager: Recommended.

Store long random credentials in a trusted manager instead of relying on memory or reuse.

Method and limitations

Methodology and assumptions

Formula, inputs, limitations and review record
Generation method

Password = Web Crypto random selections from the enabled character sets, including at least one character from every enabled set

Inputs used

Password length, Uppercase option, Lowercase option, Number option, Symbol option, Ambiguous-character option

Limitations

The generator cannot protect an account after the password leaves this browser. It does not check breach lists, enforce a destination's password policy, store or recover credentials, prevent phishing, or provide multi-factor authentication.

Review record

Method and sources checked on July 13, 2026. The documented method, source timing, validity conditions, and reliance limits were checked on this date.

Method provenanceDeterministic · toolkitshelf.password-web-crypto.v1
Maintained by
Toolkit Shelf
Calculation class
Deterministic
Method version
toolkitshelf.password-web-crypto.v1
Source date
Accessed July 13, 2026
Source checked
July 13, 2026
Intended audience
People generating a unique random credential locally before storing it in a trusted password manager.
Valid when
Use a browser with crypto.getRandomValues, select at least one character set, confirm the destination's password rules, keep the result unique, and store it securely. The entropy number is an approximate alphabet-size model rather than a security guarantee.
Reliance boundary
The generator supplies random text, not account protection, secure storage, breach monitoring, phishing resistance, recovery, multi-factor authentication, or a guarantee that a destination accepts the selected characters.
Data freshness
The browser Web Crypto API and current NIST password guidance were checked on July 13, 2026. No external password database, server request, or live account policy is used.
Cite this page

Toolkit Shelf. Secure Password Generator. https://toolkitshelf.com/tools/password-generator

FAQ

Common questions

Does Toolkit Shelf store generated passwords?

No. Generation happens in your browser, and Toolkit Shelf does not upload or save the generated password.

What makes the random selection suitable for passwords?

The generator uses crypto.getRandomValues and rejection sampling instead of Math.random or biased modulo-only selection.

Why exclude ambiguous characters?

Characters such as I, l, 1, O, 0, and o can be confused when a password is read or typed manually. Excluding them slightly reduces the alphabet but can reduce transcription mistakes.

Does the entropy number guarantee security?

No. It is an approximate search-space estimate. Account security also depends on uniqueness, storage, phishing resistance, rate limiting, multi-factor authentication, and the destination service.