Is it safe to use these as real passwords?

Passwords generated in your browser never leave your device. Passwords generated through the API travel over the network, so use the browser tool for anything you intend to rely on, and prefer a password manager for personal credentials.

Is the randomness secure?

Yes. It uses the platform cryptographic random source with rejection sampling to avoid the modulo bias that a naive implementation introduces.

Secure Password Generator

A secure password generator produces random passwords using a cryptographically secure random number source.

Passwords are generated from the Web Crypto API in the browser, or Node’s crypto module through the API, with rejection sampling so every character is uniformly distributed. Nothing is transmitted or stored when you generate in the browser.

Options

Name	Type	Default	Description
`count`	integer	`5`	How many records to return, from 1 to 1000.
`length`	integer	`16`	Password length, 4 to 128.
`symbols`	boolean	`true`	Include punctuation characters.
`numbers`	boolean	`true`	Include digits.
`uppercase`	boolean	`true`	Include upper-case letters.

Use cases

Test account credentials: Create strong passwords for seeded test accounts.
Password policy testing: Check length and character-class rules against generated candidates.

REST API

GET /api/v1/passwords

curl "https://ukaddressgenerator.org/api/v1/passwords?count=5"

{ "status": "success", "count": 1, "data": ["k7#Qm2vT!pR9wZ4x"] }

Frequently asked questions

Is it safe to use these as real passwords?: Passwords generated in your browser never leave your device. Passwords generated through the API travel over the network, so use the browser tool for anything you intend to rely on, and prefer a password manager for personal credentials.
Is the randomness secure?: Yes. It uses the platform cryptographic random source with rejection sampling to avoid the modulo bias that a naive implementation introduces.

Generating passwords correctly

Secure randomness, modulo bias and where to use each source · 150 words

1. Math.random is not enough

JavaScript's Math.random is a pseudo-random generator with no security guarantee and, in some engines, a predictable internal state. Anything that becomes a credential should use the Web Crypto API in the browser or Node's crypto module on the server.

2. The modulo bias trap

Taking a random 32-bit value modulo the alphabet length skews the distribution towards the first characters unless the alphabet size divides evenly into 2^32. Rejection sampling — discarding values above the largest exact multiple — removes the bias. This generator uses it.

function secureIndex(max) {
  const limit = Math.floor(0xffffffff / max) * max;
  const buffer = new Uint32Array(1);
  let value;
  do {
    crypto.getRandomValues(buffer);
    value = buffer[0];
  } while (value >= limit);
  return value % max;
}

3. Length beats complexity

Entropy grows linearly with length and only logarithmically with alphabet size. A 20-character password from a 62-character alphabet is far stronger than a 10-character one with punctuation, and easier to handle. Current NCSC guidance favours length and a password manager over forced complexity rules.