Roftr Labs

Developer

Random Password and Token Generator

Cryptographically secure passwords and hex tokens, with the entropy shown.

Runs entirely in your browser. Nothing you paste is uploaded.

Generated in your browser and never transmitted. We could not see these values even if we wanted to — but they are also not stored, so copy one before leaving the page.

1 value

ksuUH{kquzY7{LA@VeZY
129 bitsExcessive for a password, appropriate for an API key or a signing secret

Each value is drawn from 86 possible characters. Entropy measures how many guesses an attacker needs, and it only holds because every character is chosen independently and with equal probability — a generator that reuses a random byte unevenly would show the same number while being materially weaker.

  • Drawn from 86 possible characters using the browser's cryptographic random source, never Math.random().

How to use it

  1. Choose what you want generatedThere is no text to paste. Use "What to generate" to pick between a password meant for a person and a token meant for a machine; a value appears straight away. Everything happens inside your browser — nothing is uploaded, so there is nothing for us to store, log or lose.
  2. Read the result as it updatesThere is no button to press. A fresh value appears immediately, and a new one every time you change an option. The output recomputes every time you change the text or one of the options above it.
  3. Choose what you are generatingA password meant for a person to type, or a token meant for a machine. They want different things: one has to be typable, the other only has to be unguessable.
  4. Set the length or the byte countLength counts characters; bytes counts entropy before encoding. For an API token, 32 bytes is the usual answer and is far stronger than a 32-character password.
  5. Generate a batch if you need several"How many" produces a list in one go, which beats reloading and copying one at a time.
  6. Know where the randomness comes fromYour browser's cryptographic random source, never Math.random, and nothing is transmitted — so no server ever holds a value you are about to use as a secret.
  7. Copy or download the resultThe buttons under the output put it on your clipboard or save it as a file, and each one says exactly what it will copy or download. Any note about something the tool changed or deliberately left alone is shown with the result rather than hidden.

About this tool

This generates random passwords and API tokens in your browser, using the cryptographic random number generator rather than Math.random(). It reports the entropy of what it produced, so you can judge the strength rather than trust an adjective.

Two details here are impossible for a user to check and easy to get wrong. Both are handled: the randomness comes from a cryptographic source, and the character selection uses rejection sampling to avoid modulo bias.

Understanding the result

Entropy in bits is the honest measure of strength: each bit doubles the work of guessing. Under about 60 bits is weak for anything exposed to the internet; 128 bits is beyond brute force with any foreseeable hardware.

Excluding ambiguous characters — I, l, 1, O, 0, o — costs a little entropy and is worth it whenever a person has to read the value off a screen and type it somewhere else. The reported entropy accounts for the smaller alphabet.

The hex token option produces the format most APIs and libraries expect for a secret, sized in bytes rather than characters.

Example

Input

20 characters · upper, lower, digits, symbols

Output

q7#Vt2ZmXe9!Ld4wRb6s
≈ 126 bits of entropy

Limitations

  • Nothing is stored. Copy the value before you leave the page — we cannot show it to you again, and that is deliberate.
  • A generated password is only as safe as where you put it. A strong password in a plain-text file, an email or a chat message is a weak one.
  • Composition rules ("must contain a symbol") reduce entropy slightly by constraining the output. Length buys far more strength than any character-class rule.
  • The generator runs on your device, so its randomness is your browser's. Every current browser provides a cryptographically secure source; a very old one may not.

Questions

Are these passwords sent to or stored on your server?

No. They are generated on your device and never transmitted. There is no log, no history and no way for us to see one — which also means we cannot recover a value you did not copy.

How long should a password be?

Length matters more than complexity. With upper case, lower case and digits, sixteen characters is about 95 bits — strong. For anything protecting other credentials, take it to 20 or more, and use a password manager so length costs you nothing.

What is modulo bias and why does it matter?

The obvious way to pick a character from an alphabet — take a random byte modulo the alphabet size — makes some characters more likely than others whenever the size does not divide 256. It silently lowers the real entropy of every value produced. This generator discards the uneven tail of bytes instead, so every character is equally likely.

Can I use these for API keys and signing secrets?

Yes. For machine-to-machine secrets prefer the hex token at 32 bytes, which is 256 bits and the conventional size for the purpose.

Last updated 2026-08-16.

Related tools