Secure Password Generator Online with CSPRNG

Secure password generator

Passwords are generated on the server using PHP random_int(), backed by the operating system cryptographic random source.

Length Allowed range: 8 to 128 characters. For generated passwords, longer is generally stronger when the target service accepts it.

Lowercase letters Uppercase letters Numbers Symbols Avoid ambiguous characters (0 O 1 l I)

Character-set behavior

The generator guarantees at least one character from every enabled set, fills the remaining positions from the combined pool and then securely shuffles the result.

RANDOMNESS

The generator uses a cryptographically secure source

PHP random_int() returns uniformly selected integers from a cryptographically secure source supplied by the operating system. That makes it appropriate for generating values that must be difficult to predict, including long-term secrets.

LENGTH

For random passwords, length is extremely valuable

A machine-generated password does not need to be memorable. When a password manager will store it, using a longer unique password is generally preferable as long as the target service accepts the chosen length and characters.

COMPOSITION

Character classes are a generator preference, not a universal password policy

This generator lets you select lowercase, uppercase, numbers and symbols because generated credentials often need to satisfy service-specific requirements. That does not mean websites should force arbitrary composition rules on users. Modern guidance emphasizes sufficient length, blocking compromised passwords and allowing password managers.

UNIQUENESS

Never reuse a generated password across services

A long random password loses much of its practical security benefit if the same credential is reused elsewhere and one service is compromised. Generate a different password for each account and store it in a trusted password manager.

LIMITS

The destination system still defines what it accepts

Some legacy systems reject specific symbols or impose short maximum lengths. When that happens, adjust the generator to the service requirements, but prefer increasing length instead of unnecessarily shrinking the character space.

Frequently asked questions

Is random_int() appropriate for password generation?+

Yes. PHP documents random_int() as using a cryptographically secure source and suitable for generating long-term secrets.

Why guarantee one character from each selected set?+

Some services still require passwords to contain multiple character classes. The generator guarantees those selected classes while filling the remaining positions randomly.

Is 20 characters always enough?+

There is no universal length for every threat model. Twenty random characters from a large character pool is a strong practical default, but use longer values when supported and when the account is especially important.

Should every website require uppercase, lowercase, numbers and symbols?+

No. Modern password policy guidance generally favors length, compromised-password screening and password-manager support instead of arbitrary composition rules. The options here exist mainly for generated-password compatibility.

What does the bit estimate mean?+

It is an approximate measure of the generator search space under its random-generation assumptions. It should not be interpreted as a guarantee of real-world security.

Why remove ambiguous characters?+

Characters such as 0/O and 1/l/I can be confused when a password is read aloud or typed manually. Removing them improves usability at the cost of a small reduction in the available character pool.

Can I reuse a generated password?+

You should not. Use a unique password for every service so that a compromise at one provider does not directly expose accounts elsewhere.

Does this page store generated passwords?+

This PHP page does not intentionally persist them, but generated values necessarily exist in the server response and browser page. Server, proxy or application logging configuration should still be reviewed independently.