Generate a password
Create random passwords that cannot be guessed from earlier ones, one at a time or in batches, such as two passwords of 16 characters. Choose lowercase, uppercase, digits and symbols, and leave out look-alike characters such as 0 and O. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Weak, reused or predictable passwords are still the fastest way into an account, and hand-rolled random.choice() loops rarely produce truly unpredictable output.
Why the source of randomness matters
Weak, reused or predictable passwords are still the fastest way into an account. Many homemade generators rely on the default random function of a programming language, which is quick but built for games and simulations: after seeing a few of its outputs, an attacker can sometimes work out the next ones. A password that protects an account needs its randomness from a cryptographically secure source instead, so that no earlier password says anything about the next. That is the only kind of source this generator uses, which means each character is drawn so that guessing it is no easier than guessing any other.
Choosing the settings that fit your rules
Start from the policy the password has to meet. Set the length, then pick which kinds of characters to include: lowercase letters, uppercase letters, digits and symbols. If people will read the password out loud or copy it by hand, drop the characters that are easy to confuse. You can ask for a single password or for a batch, for example two passwords of 16 characters each, which is handy when you set up several accounts at once. A common use is creating a temporary password for a new user at sign-up, so nobody has to invent one or write the character rules by hand.
Why 'random-looking' isn't random
Most in-house password generators lean on a language's default pseudo-random number generator, which is fast but predictable enough that, given a few outputs, an attacker can sometimes infer future ones. A password meant to protect an account needs entropy sourced from a cryptographically secure generator, not from a PRNG built for simulations or games.
What you can do with it
Onboarding new users
Generate a temporary, policy-compliant password at account creation time and email it through your own signed link flow, without ever hand-coding character rules.
FAQ
Is the output actually cryptographically secure?
Yes, passwords are produced with a cryptographically secure random source rather than a standard pseudo-random generator, which is the property that matters for anything protecting real accounts.
What happens if a request fails?
The system retries automatically up to three times; if it still fails you get a clear error and are never charged for that request.
Are generated passwords stored or used for training?
No, generated values are deleted after the retention window and are never used to train any model.
What length and complexity can I set?
You control the exact length and which character classes to include, so you can match anything from a simple 8-character alphanumeric rule to a long symbol-heavy policy.
Can I leave out characters that look alike, such as 0 and O?
Yes. Turn on the option to drop ambiguous characters and l, o, 0, 1, I and O are never used. That helps whenever a password will be read aloud, written on paper or typed by hand.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/dev/password-gen \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"count":1,"length":20}'const res = await fetch("https://api.kit.forhosting.com/dev/password-gen", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"count": 1,
"length": 20
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/dev/password-gen",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"count": 1,
"length": 20
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/dev/password-gen", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"count":1,"length":20}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"count":1,"length":20}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/dev/password-gen", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"count": 1,
"length": 20
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "dev.password_gen",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
This password generator API delegates the job to a cryptographically secure random source and hands back strings built to your exact policy, one call at a time or by the thousand.
What you control
Each request accepts length, and which character classes to include: lowercase, uppercase, digits, and symbols, plus flags to exclude ambiguous characters like 0/O or l/1/I when passwords will be read aloud or typed by hand.
How the request flows
Call POST /dev/password-gen with your parameters and the endpoint immediately returns a task_id; the actual generation happens asynchronously on our global edge. You get the result back through a signed webhook, which we recommend for anything automated, or by fetching a signed link that stays valid for 24 hours. Nothing about the request or its output touches training data, and generated values are deleted once the retention window closes.
Where it fits your pipeline
A failed generation is never billed: the system retries up to three times before returning a clear error, so you pay only for passwords that actually exist. Teams call this endpoint from CI/CD scripts to seed test databases, from admin panels to set temporary credentials for new users, and from infrastructure tooling to rotate service-account secrets on a schedule. Because access requires prepaid balance rather than a rate-limited free tier, the endpoint stays fast and free of the abuse patterns that plague open password generators.
Integration use cases
Rotating service-account secrets
Schedule a cron job that calls the endpoint monthly to replace database or API credentials, cutting the blast radius if one ever leaks.
Seeding test environments
Request a batch of hundreds of unique passwords in a single call to populate staging fixtures without writing a custom generator for every project.
Enforcing client-specific policies
Generate passwords that satisfy a legacy system's odd rules, like 'no symbols, exactly 12 characters', by simply adjusting the request parameters.
Technical questions
Is this password generator API free?
The tool above runs free in your browser. The API is paid — each call draws from your prepaid ForHosting KIT balance: top up from $10.00 (it never expires), pay each request's published price, and a call with no balance returns HTTP 402. No subscription, no tokens, and a failed task is never charged.
Can I generate passwords in bulk?
Yes, a single call to POST /dev/password-gen can request many passwords at once, which is faster and cheaper than looping single requests for bulk provisioning.
Can I exclude confusing characters like 0, O, l and 1?
Yes, an option in the request excludes visually ambiguous characters, useful for passwords that will be read aloud or typed from a printout.
How do I get the generated password back?
The endpoint is asynchronous: it returns a task_id immediately, and the result arrives via a signed webhook or a signed link valid for 24 hours.