Random Password Generator

This tool generates one or more random character strings in your browser. You choose a length, quantity, allowed character groups, and characters to exclude. The password-generation function does not intentionally send or save the generated values.

Use a reputable password manager to store a different password for every account. A generated password is useful only if it remains secret and the receiving service accepts its length and characters.

Method used

SoupCalc builds one character pool from the selected lowercase letters, uppercase letters, digits, and symbols, then removes every excluded character. It obtains unsigned 32-bit random values from the browser's Web Crypto API.

Directly applying a remainder operation can make some characters slightly more likely when the random-number range is not evenly divisible by the character-pool size. The implementation therefore uses rejection sampling: values in the incomplete top interval are discarded before the remaining value is mapped to a character. This preserves a uniform mapping when the browser's cryptographic random source is functioning correctly.

The generator samples from the combined pool. It does not guarantee that every generated password contains at least one character from every selected group. If a website imposes a composition rule, check the output or generate again.

Worked example

Suppose you select lowercase, uppercase, and digits; keep the default exclusion list; and request 16 characters. After exclusions, the pool contains 51 characters: 21 lowercase letters, 23 uppercase letters, and 7 digits.

The theoretical search space is 51¹⁶, equivalent to about 16 × log₂(51) = 90.8 bits if each position is generated uniformly and the result is not exposed. Clicking Generate produces a new unpredictable value, so a fixed example password would be misleading and should not be copied as a shared secret.

Use the generated result once, save it directly in your password manager, and clear it from any clipboard history or shared screen where practical.

Security interpretation

Length and uniqueness matter more than satisfying predictable human composition patterns. Current NIST guidance for verifiers requires at least 15 characters for a password used as a single authentication factor, permits shorter passwords of at least eight characters when they are used only within multi-factor authentication, and recommends allowing at least 64 characters. A receiving service may apply different rules.

Use multi-factor authentication or a passkey when available. Passwords are not phishing-resistant, and a long random password cannot protect a session from malware, a compromised browser extension, deceptive account-recovery flows, or disclosure to the wrong site.

Do not rotate a strong unique password on an arbitrary schedule merely to meet outdated advice; change it when there is evidence of compromise, when it was reused, or when the service instructs you to replace an exposed credential.

Security boundaries

Generation occurs in the current browser context. A compromised device, browser, extension, dependency, or page can defeat that protection.
Do not generate sensitive credentials on a public or untrusted computer.
The tool does not compare outputs with breached-password blocklists. Random generation makes common human choices unlikely, but it does not check exposure after generation.
Excluding characters reduces the character pool. Compensate with adequate length when a system permits it.
A theoretical bit count assumes independent uniform samples and secrecy; it is not a guarantee of account security or cracking time.
SoupCalc cannot recover a generated password. Store it before leaving the page.

Sources

Editorial record

Written and manually reviewed by the SoupCalc Editorial Team. The local generation path, rejection-sampling behavior, and worked example were checked against the current implementation and automated tests. Last reviewed: August 10, 2026. This page remains unavailable for indexing and advertising until all approved localizations pass review.