Create strong, cryptographically random passwords instantly in your browser. Set the length, pick letters, numbers, and symbols, then copy any password or download the full batch - all processing stays on your device.
Technical Specifications
Entropy source and generation rules used for every password.
| Specification |
Details |
| Entropy source |
Web Crypto API (crypto.getRandomValues) with rejection sampling - every character has equal probability |
| Password length |
4 to 128 characters, default 16, adjustable by number field or slider |
| Character sets |
Uppercase A-Z (26), lowercase a-z (26), numbers 0-9 (10), symbols (27) - 89 symbols combined |
| Ambiguous filter |
Optional removal of I, l, 1, O, 0 for codes that are read aloud or typed by hand |
| Batch size |
1 to 100 unique passwords per click, each drawn independently |
| Entropy formula |
bits = length x log2(pool size); a 16-character full-set password carries about 104 bits |
| Processing location |
100% client-side JavaScript in your browser memory; nothing is uploaded |
| Export |
Copy all to clipboard, copy any single password, or download a plain-text report |
| Usage limit |
None - generate unlimited passwords for free, no signup required |
Understanding Password Strength
Password strength comes down to two factors: length and unpredictability. Each extra character multiplies the number of guesses an attacker must try, and drawing those characters from a cryptographic source means no shortcut exists. A 16-character password from an 89-symbol pool has about 104 bits of entropy - roughly 20 thousand billion billion billion combinations.
Length beats complexity tricks
Common substitutions like replacing E with 3 add almost no security because guessing software tries them first. Adding two genuinely random characters helps far more than any clever pattern. That is why the default here is 16 characters: long enough to resist offline brute force for decades, short enough to paste into almost any login form.
What the entropy number means
Entropy in bits is length multiplied by log2 of the pool size. A 12-character password from lowercase letters alone carries about 56 bits, while the same length from the full 89-symbol pool carries about 78 bits. The breakdown card shows this value live, plus a rating: under 45 bits is weak, 45 to 69 is fair, 70 to 99 is strong, and 100 or more is very strong. To check an existing password rather than a new one, run it through the Password Strength Checker.
When to exclude ambiguous characters
Characters like capital I, lowercase l, digit 1, capital O, and digit 0 look identical in many fonts. When a password must be read over the phone or typed from print, excluding them prevents lockouts at the cost of a slightly smaller pool. For passwords you only ever copy and paste, leave them included for maximum entropy.
Honest limitations
No generator can fix password reuse: a strong password used on ten sites falls with the weakest one, so pair this tool with a password manager and unique passwords per site. Some older systems cap lengths or reject symbols - shorten the length or untick Symbols to fit their rules. The tool also cannot check breach databases, since that would require sending data to a server, which this design refuses to do.
Privacy and Client-Side Security
Privacy Guarantee: All generation occurs locally inside your browser. Your passwords and settings are never transmitted, stored, or recorded on remote servers.
Many online generators fetch randomness or log results on a server, which defeats the purpose of a secret. TinyToolzz keeps everything in-page: entropy sampling, character mapping, and shuffling run with plain JavaScript in your tab's memory.
Because nothing is uploaded, there is no waiting, no account, and no copy of your passwords retained anywhere. Your values exist only in the tab's memory and are discarded when you close the page or click Clear.