Bulk Password Generator
Generate a list of random passwords at once, for provisioning rather than for one account.
How many — 10
Length — 20
How this works
Each password is drawn character by character from the alphabet you select, using crypto.getRandomValues rather than Math.random — the distinction matters, because Math.random is a fast non-cryptographic generator whose output is predictable from a few samples and is entirely unsuitable for credentials. Entropy is reported as length times the log of the alphabet size, which is exact for a uniformly random draw. The bulk framing exists for provisioning: setting up many accounts at once, where the useful output is a list you can paste into whatever will hold them.
What the results mean
- Entropy each
- Bits per password. Above about 75 is comfortably beyond brute force for any realistic attacker.
- Alphabet size
- How many distinct characters each position draws from. Excluding look-alikes costs a little entropy and saves transcription errors.
- Randomness source
- crypto.getRandomValues. The correctness of everything here rests on it.
- Transmitted
- Never. Closing the tab destroys the list, which is the intended lifecycle.
Common problems and fixes
- I need these in a spreadsheet
- Copy as CSV puts them on the clipboard as numbered rows. Treat the resulting file as a credential store and delete it once the passwords are where they belong.
- Excluding look-alikes weakens them
- Slightly, and usually worth it. Removing 0/O and 1/l/I costs about a bit per character and eliminates a category of support call.
- Can I regenerate the same list later?
- No, and deliberately. There is no seed to reproduce, because a reproducible password list is a much worse idea than an unrecoverable one.
Frequently asked questions
Why not use Math.random?
Because it is not cryptographically secure. Its output is predictable from a handful of previous values, which means an attacker who sees one password can derive others. crypto.getRandomValues exists precisely for this.
How many bits do I need?
Above about 75 bits nothing brute-forces it within any realistic horizon. A 20-character password from a full alphabet clears that comfortably; the risk moves entirely to reuse and storage.
Is generating passwords in a browser safe?
The generation is sound — it uses the platform CSPRNG and nothing is transmitted. The risk is what happens after: a list left in a tab, or saved as a CSV, is a credential file.
Put this on your own site
Free to embed, no attribution required beyond the source link the frame carries itself. It runs entirely in your visitor's browser, sets no cookies and loads no third-party script.
<iframe src="https://runthetests.com/embed/bulk-password-generator/" width="100%" height="560" style="border:1px solid #e5e5e5;border-radius:8px" title="Bulk Password Generator" loading="lazy"></iframe>
Preview it at https://runthetests.com/embed/bulk-password-generator/. Embedded pages are marked noindex, so yours stays the canonical copy — not this one.