Password Generator

Generates a random password from your chosen character sets — uppercase letters, lowercase letters, numbers and symbols — at a length you pick between 6 and 64 characters.

Turn on the character types you want to include, then drag the length slider between 6 and 64 characters. A password appears immediately and updates whenever you change the length or character options. Click "Regenerate" for a fresh password with the same settings, or copy the current one with the copy button.

Each character comes from your browser's Web Crypto API (crypto.getRandomValues), a cryptographically secure random number generator designed for security-sensitive uses like this one — unlike Math.random(), which is not suitable for generating passwords or tokens.

With all four character types on and length set to 16 (the default), the pool is 88 possible characters per position — 26 uppercase, 26 lowercase, 10 digits and 26 symbols — giving roughly 6×10^30 possible combinations, far beyond what's practical to guess by brute force.

Longer passwords resist brute-force guessing far more effectively than adding more character types to a short one. For an important account, 16 characters or more with all four types enabled is a solid default; for a system that limits allowed characters or length, disable the sets it doesn't accept rather than editing the password by hand afterward.

The character-to-position mapping uses a modulo operation over the selected character pool, which introduces an extremely small statistical bias toward characters near the start of the pool rather than a perfectly uniform distribution — not a practical weakness at these pool sizes, but worth noting for completeness. Generating a strong password here doesn't protect it afterward; how you store and share it still matters.

This follows current guidance on using a cryptographically secure random source (the Web Crypto API, as specified by the W3C) instead of a general-purpose pseudo-random generator for security-sensitive values. Generation runs entirely in your browser using crypto.getRandomValues; Quiklio never sees, transmits or stores the passwords you generate.