Password Generator
Generate a random, strong password of the length and character types you choose, using your browser's cryptographically secure random number generator — not a predictable Math.random() based generator.
Save your student profile to track computations, past questions & GPA targets.
Password generator
—
How It Works
This tool uses the Web Crypto API's crypto.getRandomValues() to pick each character, rather than JavaScript's Math.random(). Math.random() is a fast pseudo-random generator designed for things like games and animations — it makes no guarantee of unpredictability, and on many JavaScript engines its internal state can be inferred from a handful of outputs, which would let someone predict future "random" passwords. crypto.getRandomValues() is backed by your operating system's cryptographically secure random source, so each character is drawn unpredictably from the character sets you select (uppercase, lowercase, numbers, symbols). The strength meter is a simple, honest heuristic based on length and how many different character types you're using — it's a rough guide, not a guarantee against any particular attack.
MyDelsu is an independent student platform and is not affiliated with DELSU administration. This tool is provided for guidance only — always verify results against your official transcript, result slip, or academic regulations.
Generated passwords are never transmitted, logged, or stored anywhere by this tool — they exist only in your browser tab's memory while the page is open, and disappear when you leave or refresh the page.
Frequently Asked Questions
Is Math.random() really not good enough for passwords?+
Correct — Math.random() is a statistical PRNG, not a cryptographic one. It's fine for shuffling a quiz or animating a UI, but its output can, in principle, be predicted from previous outputs on some engines, which is a real weakness for something meant to be a secret. crypto.getRandomValues() doesn't have this problem.
Do you store or see the passwords I generate?+
No. Passwords are generated and held only in your browser tab's memory for as long as the page is open — they are never logged, transmitted, or stored by this tool in any form.
What length should I use?+
Longer is generally stronger: 16+ characters with a mix of uppercase, lowercase, numbers, and symbols is a reasonable default for most accounts. For anything protecting sensitive data, consider 20+ characters where the service allows it.
Why does the strength meter show 'Fair' or 'Weak' for a short password even with symbols enabled?+
Length is the single biggest factor in how hard a password is to brute-force, so a short password gets a lower score even when it draws from every character type. Turning on more character types alone can't fully make up for a short length.