Free generator
Free Password Generator
Use a memorable base word, mix character sets, and generate privately in your browser.
Type something memorable like coffee— we’ll weave it into a stronger password.
How to use
1. Optionally type a base word you can remember (for example coffee).
2. Set length and character sets. Enable leetspeak only if you want substitutions on the base word. Exclude lookalikes if you will type the password by hand.
3. Copy the result, or regenerate for a new variation.
4. Save it in a reputable password manager and turn on 2FA for important accounts.
What this generator does
It builds a password in this browser from the sets you enable: uppercase, lowercase, numbers, and symbols !@#$%^&*()-_=+[]{};:,.?. Length can be 4–128 characters. If you leave a character set off, that pool is not used. If every set is off, the tool returns an empty string rather than inventing a fallback.
How randomness is generated
Each random index comes from crypto.getRandomValues on a 32-bit unsigned integer — not Math.random. Without a base word, GenShelf first picks one character from each enabled set so a “numbers + symbols” password cannot accidentally omit a set, then fills the rest from the combined pool, then shuffles with Fisher–Yates using the same CSPRNG.
Index selection uses remainder (value % poolLength). For pools of a few dozen characters versus a 2³² range, the bias is negligible for this use. It is still worth saying plainly: this is a practical browser generator, not a hardware HSM.
Base words and leetspeak
A base word is stripped of spaces and capped at 48 characters. It stays contiguous — you can still see “coffee” (or a leet variant) as one chunk. Random filler is inserted before and after it at a random offset. That helps when you must type on a TV or a router sticker. It does not make the word itself unpredictable. Attackers try dictionary roots.
Leetspeak maps a, e, i, o, s, t (and capitals) to @, 3, 1, 0, $, 7 — but only on even character indexes, so the word stays partly readable. Crackers already try those substitutions. Treat leet as a typing aid, not extra strength.
What the strength meter is (and is not)
The label (Too weak → Very strong) adds points for length at 12, 16, and 20 characters, plus extra points when three or four character sets are enabled. It does not compute Shannon entropy, and it does not penalize a dictionary base word. A 16-character string of coffee!!!!!!!!!!!! would not be produced by this tool’s random path, but the meter is still a rough UI hint. For the real workflow, see how to create a strong password and managers vs generators.
Is the password generator private?
Nothing you type or generate is sent to GenShelf. There is no account and no server-side log of the secret. Clipboard copy is the usual next step — a password manager is safer than a notes app. Browser extensions can still read the page; GenShelf cannot stop a malicious extension. More on the model: what stays in your browser.
FAQ
Can I use my own word in the password?
Yes. An optional base word stays as a readable chunk. Random characters from the selected sets wrap around it at a random insert position. Leetspeak substitutes about every other eligible letter (a→@, e→3, and similar).
Are these passwords secure?
Random characters come from crypto.getRandomValues, not Math.random. A memorable base word is convenient but weaker than a fully random string of the same length. Prefer 16+ mixed characters and a password manager.
Does GenShelf see or save my passwords?
No. Generation is fully client-side. Nothing you type or generate is uploaded. Closing the tab without copying discards the secret — this page is a generator, not a vault.
What length should I use?
Sixteen characters or more with letters, numbers, and symbols is a solid default for important accounts. Length is capped at 128. Use a password manager when you can so length is not limited by what you can type from memory.
How does the strength label work?
It is a heuristic, not a lab entropy measurement. It scores length thresholds (12, 16, 20) plus how many character sets you enabled. A base word is not subtracted from that label — treat the meter as a reminder, not a guarantee.
What do “exclude lookalikes” do?
They remove characters that are easy to confuse when typing by hand (i, I, l, 1, L, o, O, 0). Useful for Wi‑Fi cards; less necessary when a manager autofills.
Related guides
- How to create a strong password (and remember it)Length, randomness, password managers, and what to avoid — practical advice you can apply today.
- Password managers vs password generators: what each one is forGenerators create strong secrets; managers store and autofill them. How to use both without mixing up the jobs.
- What stays in your browser: how GenShelf generators handle privacyWhat each tool creates on-device, what localStorage remembers, and how to verify nothing is uploaded — written from how GenShelf is actually built.