Cryptographic Password Generator
Generate strong random passwords of any length using your browser's cryptographic random generator.
Why use this tool?
Create strong, random passwords using your browser's cryptographic random generator. Every chosen character type is guaranteed to appear.
How to use it
- Set the length (16+ is recommended).
- Choose uppercase, numbers and symbols.
- Copy the password into your password manager.
How the passwords are generated
Every character is chosen with your browser's cryptographically secure random generator (crypto.getRandomValues), the same source used for encryption keys, not the predictable Math.random. Characters are picked without bias, and every character type you select (uppercase, numbers, symbols) is guaranteed to appear at least once, so the password passes sites that require each type.
You can choose a length from 8 to 64 characters. The password is generated on your device and never sent anywhere.
How long is long enough?
A password's strength comes from the number of possible combinations, which grows exponentially with length. With all character types (about 94 possible characters), each character adds roughly 6.5 bits of entropy: 12 characters give about 79 bits and 16 characters about 105 bits. Against offline cracking with modern hardware, 16 or more random characters is comfortably out of reach.
Length matters more than complexity. A 20-character password of lowercase letters only is stronger than a 10-character one using every symbol, so if a site restricts symbols, make the password longer instead.
Using generated passwords well
Use a different password for every account. Most account takeovers come from passwords leaked by one site and reused on others (credential stuffing), not from guessing. A password manager makes this practical: it stores and fills random passwords so you only remember one strong master passphrase.
Turn on two-factor authentication for important accounts such as email, banking and cloud storage. Even a perfect password can be phished, and a second factor stops most of those attacks.
Frequently asked questions
Is the password sent to KitLoop?
No. It's generated in your browser with its secure random generator and never leaves your device.
What length should I use?
16 characters or more for important accounts. If a site limits length or symbols, use the longest allowed.
Is a random password better than a passphrase?
Both can be strong. A passphrase of five or more random words is easier to type and remember; a random character password is shorter for the same strength. Store either in a password manager.