🍪 This site uses cookies to improve your experience. Cookie Policy · Privacy Policy

cryptographically secure · client-side CSPRNG

Generate passwords via API

Developer-friendly, cryptographically secure password generation. Supports JSON, CSV, and plain text output. Live API simulator with code examples in 5 languages. No server transmission — ever.

curl — client-side simulation
$ curl -X GET "https://randompasswordtool.com/api/v1/generate?count=5&length=20&charset=ulns&format=json
-H "X-API-Key: rpt_demo_a8f3c9e2b7d1"
-H "Accept: application/json"

{
"status": "ok",
"count": 5,
"entropy_bits": 143,
"passwords": […]
}

Live API Simulator

crypto.getRandomValues() · NIST SP 800-90A
GET https://randompasswordtool.com/api/v1/generate ?count=5&length=20&charset=ulns&format=json
Parameters
Charset
Format
Prefix (optional)
Query String
?count=5&length=20&charset=ulns&format=json
API Response · awaiting request
Hit SEND REQUEST to generate passwords via crypto.getRandomValues()
API Key rpt_demo_••••••••••••••••••••••••

ℹ️ This is a client-side simulation. No network request is made. Generated passwords never leave your device.

parameters update live ⚡
curl -X GET \
"https://randompasswordtool.com/api/v1/generate?count=5&length=20&charset=ulns&format=json" \
-H "X-API-Key: YOUR_API_KEY" \
-H "Accept: application/json"
import requests

response = requests.get(
"https://randompasswordtool.com/api/v1/generate",
params={"count": 5, "length": 20, "charset": "ulns", "format": "json"},
headers={"X-API-Key": "YOUR_API_KEY"}
)
passwords = response.json()["passwords"]
const params = new URLSearchParams({
count: 5, length: 20,
charset: "ulns", format: "json"
});

const res = await fetch(
`https://randompasswordtool.com/api/v1/generate?${params}`,
{ headers: { "X-API-Key": "YOUR_API_KEY" } }
);
const { passwords } = await res.json();
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => "https://randompasswordtool.com/api/v1/generate?count=5&length=20&charset=ulns&format=json",
CURLOPT_HTTPHEADER => ["X-API-Key: YOUR_API_KEY"],
CURLOPT_RETURNTRANSFER => true,
]);
$result = json_decode(curl_exec($ch), true);
$passwords = $result["passwords"];
package main

import (
"encoding/json"
"fmt"
"net/http"
"net/url"
)

func main() {
params := url.Values{
"count": {"5"}, "length": {"20"},
"charset": {"ulns"}, "format": {"json"},
}
req, _ := http.NewRequest("GET",
"https://randompasswordtool.com/api/v1/generate?"+params.Encode(), nil)
req.Header.Set("X-API-Key", "YOUR_API_KEY")
// … decode JSON response
_ = json.NewDecoder(resp.Body).Decode(&result)
}
Quick generator

Generate passwords instantly

⚡ No server · runs in your browser

Mode

why this tool

Built for developers, backed by CSPRNG

Every generation uses crypto.getRandomValues() — the same entropy source that secure shells and encrypted messaging apps rely on. Zero server transmission. Always.

🔐

Cryptographic randomness

Powered by crypto.getRandomValues() — the browser's native CSPRNG backed by OS-level entropy (/dev/urandom / CryptGenRandom). Meets NIST SP 800-90A standards.

🔌

Pipeline-ready API

Generate passwords in JSON, CSV, or plain text. Copy-paste code snippets in cURL, Python, JavaScript, PHP, or Go — adapt parameters and integrate in seconds.

🛡️

k-Anonymity breach check

Validate passwords against the HIBP breach corpus using SHA-1 k-anonymity. Only a 5-character hash prefix leaves your device — the full password never transmits.

Bulk generation

Generate up to 100 passwords at once. Perfect for provisioning CI/CD secrets, test fixtures, batch user accounts, or temporary credentials.

📊

Real-time live preview

Every parameter change updates the URL, query string, and code snippets instantly. No reload needed — what you see is what your integration will call.

🔍

Transparent source

Open DevTools and watch the Network tab — zero requests are made during generation. Every password is created client-side with verifiable entropy.

by the numbers

Why CSPRNG matters

2624
Mersenne Twister
internal states
Recoverable after 624 outputs
128+
Recommended entropy
bits for strong password
20-char with charset=ulns
0
Network requests
during generation
Client-side only · zero transmission

Check passwords against known breaches

Every password can be validated against the HaveIBeenPwned breach corpus without exposing the actual password. The k-anonymity API means only a partial hash prefix leaves your device.

🔍

k-Anonymity + SHA-1

When you check a candidate password, SHA-1 hash it, send the first 5 characters to the HIBP k-anonymity API at api.pwnedpasswords.com/range/{prefix}, then check whether the full hash appears in the response. The actual password is never transmitted — only a partial hash prefix. This pattern is required by NIST SP 800-63B 2025 as a SHALL requirement at credential creation.

// Password Security Portfolio

Each tool in this portfolio serves a distinct audience and use case.

faq

Frequently asked questions

JavaScript's Math.random() uses the Mersenne Twister PRNG — its 19,937-bit internal state can be fully recovered after observing 624 consecutive outputs. This makes generated passwords statistically predictable. Use crypto.getRandomValues(), which reads from the OS-level CSPRNG (/dev/urandom on Linux, CryptGenRandom on Windows) and cannot be predicted from observed outputs.
The Web Crypto API's crypto.getRandomValues(), which is consistent with NIST SP 800-90A (Recommendation for Random Number Generation Using Deterministic Random Bit Generators) and RFC 4086 (Randomness Requirements for Security). It is the only browser-native random source appropriate for cryptographic use.
Yes. Use the cURL snippet from the Code Generator tab, then pipe the output to gh secret set or your secrets manager of choice. Example: curl "…/generate?length=32&format=text" | gh secret set DB_PASSWORD. Never log the generated value in workflow output — use masked environment variables.
The charset flag string controls which character classes are included: u=uppercase (A-Z), l=lowercase (a-z), n=numbers (0-9), s=symbols (!@#$), a=exclude ambiguous characters (0,O,l,1,I). Combine freely: charset=uln gives alphanumeric only — useful for AD passwords with legacy system restrictions.
Free tier: 1,000 requests/day, 100 requests/minute. Rate limit headers are included in every response: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset. The API simulator on this page runs entirely client-side and does not count against limits.
No. The simulator on this page uses crypto.getRandomValues() entirely in your browser. No generated password reaches any server. Network requests during simulation: zero. You can verify by opening DevTools → Network and running the simulator.
The API supports up to 100 passwords per request. For bulk provisioning over 100 (e.g. creating 10,000 AD accounts), loop the API call in batches of 100. The Python and Go code examples in the Code Generator include a batch loop pattern. Alternatively, use the text format and process with awk or xargs.
The code snippets in all five language tabs (cURL, Python, JavaScript, PHP, Go) regenerate dynamically every time you change a parameter — count, length, charset, format, or prefix. The URL bar and query string display also update in real time. There is no reload required.
engineering blog

Security engineering deep dives

// all posts →

Amazon Security Picks

Hardware and software recommendations verified by our team.

As an Amazon Associate we earn from qualifying purchases.

admin