Strong Password Generator
Use the CaseSwitch Strong Password Generator to mint random passwords on your device with length and character-class controls. Bytes come from `crypto.getRandomValues()` when the browser supports it. Nothing is uploaded — copy the result into a password manager.
Written by the CaseSwitch editorial team. We maintain these tools in the browser so drafts, keys, and images stay on your device.
Last reviewed: 23 July 2026
Uses secure browser randomness when available. Nothing is sent to a server.
Examples
Sample output shape — 16 chars, all classes (illustrative only)
Input
length: 16 · uppercase · lowercase · numbers · symbols · quantity: 1
Output
(sample shape, not a live value) K9#mPx2$vLqN8@wR (Strong)
Sample output shape — letters and digits only
Input
length: 20 · symbols off · quantity: 1
Output
(sample shape, not a live value) aT7kQm9Lp2Xn4Vs8Hd1c (Strong)
Sample output shape — ambiguous characters excluded
Input
length: 12 · excludeAmbiguous on · quantity: 1
Output
(sample shape — no O/0/I/l/1) Kp#mVx2$qN8@ (Medium)
Sample output shape — multiple candidates
Input
quantity: 3 · length: 16 · all classes
Output
(sample shape — three independent lines) … (Strong) … (Strong) … (Medium)
Sample output shape — short policy ceiling
Input
length: 8 · all classes (site max 8)
Output
(sample shape — still store in a manager) R7#kPx2$ (Medium)
How to use
- Set length (16+ recommended) and enable the character classes your target site allows. Turn on Exclude ambiguous characters if you will type the password by hand.
- Set quantity if you want several candidates, then generate.
- Copy one password into your password manager and close or refresh the tab when finished.
What this tool is for
A browser password generator exists so you can create a high-entropy secret without sending it to a website account or a “free password API.” You choose length (default 16, up to 128), how many passwords to mint at once, and whether to include uppercase, lowercase, digits, and symbols. Optionally exclude ambiguous characters (O, 0, I, l, 1). Each line shows a simple Weak / Medium / Strong label based on length and class variety — that label is a heuristic, not a guarantee against reuse or phishing.
How it works
The tool builds a charset from the options you enable, then picks each character with `securePick`, which calls `crypto.getRandomValues()` under the hood. Quantity defaults to five lines so you can pick one you like. Symbols use a fixed printable set (`!@#$%^&*()-_=+[]{};:,.?/`). Generation never leaves this tab. Refreshing the page discards anything you did not copy.
When to use it
New account signups, rotating a password after a breach notification, creating an app-specific password, and seeding a password manager vault when the manager’s own generator is unavailable. Sixteen characters with mixed classes is a practical floor for most sites in 2026.
When not to use it
Do not generate a password and email it to yourself, paste it into a shared spreadsheet, or reuse it across sites. Do not treat this page as a memorable passphrase generator if you shortened length to satisfy a bad site policy — use the longest the site allows and store it in a manager. Do not rely on the strength label alone if you disabled most character classes.
How it compares to related tools
The UUID Generator produces identifiers, not login secrets. The Random Number Generator is for integers or decimals in a range, not mixed-class strings. MD5 or Base64 of a word is not a password. A manager’s built-in generator is equally fine; this page is the no-account alternative.
Common mistakes
Screenshotting the password, generating on a shared computer and leaving it in the output box, turning length down to eight “because the site said so” without storing the result safely, and inventing a pattern like SeasonYear! that attackers try first.
How strength labels are estimated
Each generated line appends Weak, Medium, or Strong from a simple score: length bonuses at 12 and 16 characters, plus one point each for lowercase, uppercase, digits, and symbols. Score ≥ 5 is Strong, ≥ 3 is Medium, otherwise Weak. The label does not measure against a breach corpus and does not know if you will reuse the password.
Crypto.getRandomValues and storage
Character picks use the Web Crypto CSPRNG when available. That is appropriate for passwords in a modern browser. It is not a hardware HSM. CaseSwitch does not store generated passwords. Copy into a manager (1Password, Bitwarden, Apple Keychain, etc.) and avoid plain-text notes or screenshots.
Frequently asked questions
Are these passwords cryptographically random?+
Yes when `crypto.getRandomValues` is available — that is the source used for each character pick. Avoid ancient browsers without Web Crypto.
Why do some sites reject the password?+
Silly rules (no symbols, max 12 characters, must include a quote). Generate with the classes they allow, then still store it in a manager.
Do you store generated passwords?+
No. Generation is local. If you refresh, it is gone unless you copied it.
What does Exclude ambiguous characters do?+
It removes O, 0, I, l, and 1 from the charset so hand-typed passwords are easier to read. Entropy per character drops slightly; prefer longer length when you enable it.
Is the strength label a guarantee?+
No. It only scores length and character-class variety on that string. Reuse, phishing, and malware can still compromise a “Strong” password.
Can I generate more than one at a time?+
Yes. Quantity defaults to 5 and goes up to 50. Each line is an independent draw from the same charset rules.
Are these values cryptographically secure?+
Random generators use crypto.getRandomValues() in your browser for secure randomness where supported.
How is password strength estimated?+
Strength labels are based on length and character variety. Use long passwords with mixed character types for best security.
Related guides
Read our original articles on this topic.
Related tools
UUID Generator
Primary keys across services, correlating logs between front end and API, seeding fixtures in a demo database, and generating a local test resource id without hitting a server.
Random IP Address Generator
Screenshot form fillers, placeholder datasets, teaching dotted-quad format, and synthetic logs where the exact address does not matter.
Base64 Encode & Decode
Embedding a small SVG or icon in a data URL experiment, inspecting the readable middle of a JWT (still not verifying the signature here), converting clipboard text for an API field that expects Base64, and teaching the difference between encoding and encryption with a live round-trip.
Random Number Generator
Classroom raffles, load-test IDs, sprint poker numbers, Monte Carlo toy demos, and filling numeric columns in mock CSV. Document the range if the result matters later.
Random Choice Generator
Standup facilitators, classroom names, giveaway comments exported to a text list, picking a restaurant, and assigning demo duties.